网络安全威胁情报报告：2023年第二季度及2024年最新趋势

Latest trends for Q2023 and 2024 Table of Contents 1. Executive Summary 6. Cybercrime 2. Quarterly trends 6.1. Ransomware 2.1. Geopolitical situation2.2. Quarterly incident analysis2.3 Malware trends 7.1. Critical WebP vulnerability affecting multiple applications7.2. Remote code execution vulnerability in Apache Struts 27.3. Citrix Netscaler ADC and Netscaler Gateway Vulnerability7.4. Fortinet resolves critical vulnerabilities in FortiSIEM 3. Campaigns associated with state interests 3.1. Groups associated with Russia3.1.1. APT 28 exploits WinRAR vulnerability during Russian-Ukrainian conflict3.1.2. APT 29 exploits vulnerability in JetBrains 8. Trends for 2024 8.1. Advanced Persistent Threats8.2. Multi-domain warfare8.3. Vulnerabilities8.4. Ransomware 3.2. China-linked groups 3.2.1. GhostEmperor attacks government organisation in Indonesia3.2.2. Webdav-o against Russian government agencies3.2.3. New Stayin Alive campaign attributed to ToddyCat against Kazakhstan, Pakistan, Vietnam and Uzbekistan 9. Conclusions 3.3. Groups linked to Iran3.3.1. OilRig strikes targets in Israel again 4. Hacktivism8 5. Deep web In a referendum on 4 December, Venezuelan President Nicolás Maduro consultedcitizens on the annexation of the Essequibo, an area disputed with Guyana. Madurowent on to announce the integration of this disputed region and the creation of anew Operational Zone of Integral Defence, parallel to the special military commandsoperating in other Venezuelan regions, which intensified theterritorial crisis withGuyana, especially after the military mobilisation and the official declaration of 1. Executive Summary This report summarisesthe activities recorded by Lab52, S2 Grupo’s cyberintelligence team, with a special analysis of themost significant events detectedduring the fourth quarter of 2023. The Guyanese government said it would seek help from its international partners.Nicolás Maduro and Irfaan Ali met in the Grenadines and agreed to use diplomaticmeans to find a peaceful solution to the crisis. In turn, it presents a series of trends that will shape the cybersecurity landscape in2024, undoubtedly an opportunity for organisations of all types to keep up to dateand plan their strategy throughout the year. After launching the war against Palestine,Yemen declared war on Israel andthreatened to sabotage all Israeli-flagged ships passing through the Red Sea.The threats were extended to all ships from countries supporting Israel. Following 2. Trends of thequarter the start of Iranian-backed Huthi attacks on several ships, the US announced aninternational coalition to counter threats to maritime trade.Spain stayed out ofOperation Prosperity Guardian. Major companies such as BP, Maersk and MSC Cruises decided to suspend theiroperations in the area until further notice due to the increased risk in the Red Sea.Others have chosen to divert their vessels from the route to other alternatives suchas Cape Esperance.It is estimated that 12% of the world’s shipping traffic passedthrough the area before the outbreak of hostilities.The first ship to be attacked wasthe Galaxy Leader, owned by Ray Shipping, a company partly owned by an Israelibusinessman. Since then, at least 20 ships belonging to international companies The highlights of the quarter were as follows: On 7 October, more than 2,000 Hamas troops entered Israel by surprise through 29breaches around the Gaza Strip. That Saturday was the holiday of Simchat Torah,the day when synagogues finish reading the last part of the Pentateuch in the Torah,the Jewish holy book. The attack, dubbed “Operation Al-Aqsa Storm”, left morethan a thousand people dead and scores more missing or kidnappedby the group,prompting Israeli Prime Minister Benjamin Netanyahu to declare war on Hamasshortly afterwards.The EU condemned the Hamas attacks, recognised Israel’sright to self-defence and approved several humanitarian aid shipments to Gaza. In Tensions between Taiwan and China increased following Xi Jinping’s year-endspeech, in which he hinted at a possible reunification of China on the occasion ofthe 75th anniversary of the founding of the Asian giant. The Chinese President saidthat ‘China will surely be reunified, and all Chinese on both sides of the Taiwan The war in Ukraine became even more relevant after the European Commissiondecided to open negotiations on Ukraine’s accession to the European Union, whichwas not without difficulties as this decision required the support of all EU memberstates. Hungary, which has maintained diplomatic and trade relations with Russiadespite international sanctions, was initially opposed. However,Viktor Orbán If we analyse the distribution by sector and type of campaign, we find the followingdata: 2.2 Analysis of events during the quarter In terms of sectoral impact, the distribution is as follows: It can be observed thatcyber espionage campaigns are directed against strategicsectors such as governmental and diplomatic