“Blindsided” is cybersecurity’s worst-case scenario. The threat you don’t know about; the attack you don’t see coming; the hacker hiding undetected in your networks: unknowns are what can take a company down. Exposing them is what threat intelligence lives to do. Companies in 2022 faced an array of threat actors: sophisticated advanced persistent threats, or APTs; ruthless cyber criminals; disgruntled insiders; a resurgence in hacktivism and distributed denial of service (DDoS) attacks, and more. Geopolitics dominated the headlines and the cybersphere, even as threat actors continually shifted tactics and techniques and shared their tools, motivated by sabotage, espionage and money. And in 2022, public and private sectors joining forces and sharing their intelligence bolstered organisations’ defences. Our report “Cyber Threats 2022: A Year in Retrospect” examines the threat actors, trends, tools and motivations that captured the cyber threat landscape last year. It includes incident response case studies with direct and detailed insight into tools, techniques and procedures (TTPs) used in intrusions. We also provide detection logic throughout the report to assist your defenders when scanning your own systems and networks, to help you find malicious threat actors. With context for what to expect in 2023 from the report, we strive, as always, to not only keep pace with hostile cyber activity, but to get ahead of it, and stay ahead.
Attackers will continue scouring unpatched systems for Log4Shell and other vulnerabilities and will exploit where they can. Software library vulnerabilities are also likely to be an exploitation focus for threat actors in the year ahead.
Poor or inconsistent patching regimes continue to be a key factor behind successful intrusions into networks. Most successful attacks exploit vulnerabilities that have already been remediated by manufacturers or developers and are available to customers for implementation. Successful attacks that are the result of 0-day exploits are still comparatively rare. Attackers will do the minimum they need to in order to gain access to a network and will not burn higher-end capabilities unnecessarily.
We therefore recommend that organisations prioritise defence in depth and rigorous patching in their security strategies to raise the barrier to entry for attackers.
Security and law enforcement agencies, along with the commercial security industry, will continue to use public disclosures to counter the activities of APTs and thwart their operations. Cloud service, managed service and identity and access management (IAM) providers with privileged access to client networks will increasingly become targets of choice for the most sophisticated actors – to achieve the scaled access they need to compromise the targets of their espionage and intellectual property theft operations.
In the full Cyber Threats 2022: A Year in Retrospect report, learn about these significant events and trends in more detail.
Governments will also explore the continued use of sanctions as a way of hamstringing ransomware and other threat actors, as well as their access to and use of extorted and stolen funds. Organisations will increasingly be required to build their defence efforts and security strategies to account for more frequent attacks powered by an increasingly commodotised -as-a-Service cyber criminal ecosystem.
Threat actors vary in motivation and sophistication, tailoring operations and opportunistic attacks in different sectors. In 2022, attacks in one sector cascaded to other industries and inflicted greater damage. That’s due to increased interconnections among increasingly digitised supply chains and industries.
Click on a sector to learn sector-specific motivations summarized by PwC Threat Intelligence from 2022 case studies and in-house analytics.
Military secrets and sophisticated technologies make this highly sensitive and important sector a prime target every year by cyber threats. But 2022 proved especially challenging as threat actors worked hard to penetrate A&D organizations and contractors, particularly in Europe. Their motives ran the gamut:
Espionage-motivated threat actors wanted research and development secrets as well as military plans and capabilities.
Saboteurs, hoping to weaken a rival’s defences, might try to inhibit research or halt production.
Ransomware attackers were willing to bet that high-value, defence contracting companies would pay to recover sensitive data. They often upped the ante by threatening to publish ransomed data on leak sites to collect from victims a second time.
