2024.07.24. The Fair Economy — According to a government analysis of major cyber threat trends in the private sector, spear phishing, server hacking and smishing texts have increased. The government urged citizens and businesses to pay special attention to cybersecurity to protect their assets.
The Ministry of Science and ICT, together with the Korea Internet & Security Agency (KISA), released the "2024 First-Half Cyber Threat Trends Report" on the 24th.
Looking at statistics on reported security incidents over the past three years, the number rose from 1,142 cases in 2022 to 1,277 in 2023, showing an increasing trend each year. In the first half of 2024, reported incidents reached 899, up about 35% from the same period last year. Notably, web server hacking (504 cases) and DDoS attacks (153 cases) increased significantly.
By sector, the information and communications industry accounted for the highest share with 302 cases in the first half of this year, while the wholesale and retail sector saw a 32.6% increase (126 cases) compared to the previous year. In the information and communications sector, web hosting companies have become the primary targets of cyber incidents, whereas the wholesale and retail sector appears relatively vulnerable in security management.
Notably, 93.5% of reported ransomware breaches targeted small and medium-sized enterprises, showing that attackers seeking financial gain are concentrating on companies that find it relatively difficult to secure information security professionals and invest in cybersecurity.
Jung Chang-rim, director general for information security network policy at the Ministry of Science and ICT, urged companies to raise internal security awareness and set up response systems, and called on users to be wary of texts from unidentified senders, saying, "We will do our best not only to prevent damage from breach incidents and stop their spread for citizens and businesses, but also to help recover from hacking damage through breach-incident victim support services."
Increase in virtual asset theft attacks targeting domestic blockchain companies
As the value of virtual assets such as Bitcoin has surged recently, hacking attacks targeting them have increased. Attackers are attempting sophisticated hacks on blockchain networks, virtual asset wallets and exchanges to illegally secure assets for financial gain. Internationally, the amount stolen has doubled compared with the previous year.
Attackers are using phishing emails disguised as messages from virtual asset exchange staff to distribute malware. Upon infection, they search for virtual asset wallets and private keys to steal and exfiltrate virtual assets.
To strengthen security, companies need to step up monitoring of important assets such as asset-management PCs and trading operation systems, report to KISA without delay if any damage is suspected, and build a cyber incident response system with expert support so damage can be blocked before it spreads, mastering it through repeated training.
Increase in server hacking targeting SMEs and nonprofit organizations
In the first half of 2024, reported server hacking incidents reached 504, up 58% from the same period last year, with increases in server hacking that exploited website vulnerabilities to target companies with relatively weak security management, such as small and medium-sized enterprises.
The unidentified hacker group Niyen has continued to attempt hacking attacks exploiting vulnerabilities, hacking websites of small and medium-sized enterprises and nonprofit organizations with weak security investments, stealing and publicly disclosing internal information, following last year and continuing into the first half of this year.
Corporate security managers should not only manage remote access settings and accounts but also regularly conduct vulnerability assessments and thoroughly apply security patches to external attack surfaces and exposed assets. Neglecting security patch application can lead to serious consequences such as personal information leaks, ransomware infections, business disruption, and financial losses, so particular caution is required.
The Ministry of Science and ICT and KISA are working to prevent the spread of damage by conducting joint investigations with relevant agencies upon receiving breach incident reports to analyze the causes, cooperating with software developers to find vulnerabilities, and taking emergency measures such as rapid security patches to prevent further damage.
Additionally, small and medium-sized enterprises and nonprofit organizations facing difficulties in response should apply for free information security support services operated by KISA's boho.or.kr, such as "Server Care", "Security Vulnerability Checks", and "SME Website Security Enhancement", to receive assistance in preventing cyber incidents in advance.
Increase in cyber threats using large-scale text messaging and smishing messages
In the first half of this year, there has been a sharp increase in cases of mass distribution of illegal spam and smishing texts targeting financial gain.
One reason is that while the spam-reporting function on mobile phones has improved, it cannot be overlooked that registrations of text message resending companies have sharply increased since 2020 (1,174 as of June), spreading text messaging services widely.
In addition, attackers targeting text message resending companies are sending mass smishing texts to internal members using accounts stolen by hacking the devices of administrators with text-sending authority or through phishing, or by exploiting web vulnerabilities in text-sending servers, such as file upload flaws or bypassing authentication for the sending function.
Companies developing or operating text messaging systems should take the following measures to prepare for such attacks: strengthen administrator pages and account management, enhance file upload function security, conduct regular web log checks and backups, and perform periodic malicious file checks and removal.
In addition, service users should be wary of clicking unverified URL links in text messages, install antivirus software or carrier spam-prevention apps to strengthen security, and consider using the "KISA boho.or.kr Smishing Service," which can check in real time whether a suspicious URL is malicious.
Strengthening the effectiveness and follow-up measures to minimize cyber incident damage
In response to the rise in cyber threats targeting the general public, the Ministry of Science and ICT and KISA reorganized KISA to establish a "Public Damage Response Group" — comprising the Voice Phishing Response Team, the Smishing Response Team and the Digital Threat Analysis Team — to thoroughly address digital crimes affecting public livelihoods.
They are also working to minimize damage from breach incidents through intensive monitoring of virtual asset companies and the establishment of the "KISA boho.or.kr Smishing Service," which checks in real time whether a suspicious URL is malicious.
Furthermore, to strengthen the effectiveness of cyber incident reporting for preventing the spread of damage and to enhance follow-up measures to prevent recurrence, the "Information and Communications Network Act" was amended and promulgated on February 13, and is scheduled to take effect on August 14.
The "2024 H1 Cyber Threat Trends Report" announced this time can be downloaded from the KISA boho.or.kr website (www.boho.or.kr).
0 Comments
No comments yet.