Network Threat Trends: Exploitation of Vulnerabilities and AI-Hype
Palo Alto Networks’ Unit 42 research team has reported on the malware trends it has seen in 2022 and early 2023. The emergence of ChatGPT has led to an explosion of impersonation attempts and website registrations with the aim of using the AI hype, often for deception. It is also seen that there were many more exploitations of vulnerabilities in 2022 compared to the previous year.
Exploitation of Vulnerabilities
The new Network Threat Trends research report well reflects the growing concern about existing flaws in software code. According to Unit 42, in 2022 there were 55 percent more exploitations of vulnerabilities in software than in 2021. This growth has already started in 2019. As we previously reported, Log4Shell continues to haunt us. For the realization of that analysis, the research team at Palo Alto Networks was also willing to provide insight into this vulnerability. Not only recent problems cause malware injections. Old vulnerabilities that often have a patch available for a long time remain stubbornly present. Unit 42 points to inadequate patching by organizations, but also a lack of clear accountability by software vendors.
PDFs Popular
If you do not want to take advantage of a software error, you can always scam someone by e-mail with a little persuasion. Although according to Unit 42 quite a bit of ‘social engineering’ is needed to disguise a suspicious email, malicious parties can succeed through fake PDFs. 66 percent of email infections use this file type. This compared to 9.79 percent .exe files, but also 7.85 percent .xls and 6.47 percent .xlsx (Excel). In other words, people should pay attention if they see a PDF popping up from a suspicious source.
Other continuations of existing trends include the popularity of remote code execution, where exploits through a number of steps can lead to infiltration and advanced modifications to internal infrastructure. Attacking v and cloud workloads and IoT devices stand out, with 47.3 percent of attackers aiming to install a botnet. 21.6 percent want to activate crypto mining via a coinminer, while 11.1 percent are intended for a backdoor.
OT Attacks Increase
We find a striking increase in OT attacks, i.e. on critical infrastructure such as production, water supply or energy companies. These types of attacks increased by a staggering 238 percent from 2021.
AI Hype
A truly new trend stems from the AI hype surrounding ChatGPT. We have already seen that ChatGPT is used as an accomplice in cybercrime, for example to generate credible e-mail texts. Since the hype around AI only really started at the end of 2022, Unit 42 decided to look at malware developments in this area from November 2022 to April 2023. Domain registrations that often imitate AI services like ChatGPT have exploded by 910 percent in that time. However, this is not just about malicious purposes. It also includes so-called “grayware”, such as adware, spyware and programs that the user did not want to install. Still bad, but the seriousness varies enormously.