Connect with us

GRTech

Sophos says it Anticipates AI-Based Attack Techniques and Prepares Detections

Published

on

At the Moment, Adversaries are Skeptical of AI for Cybercrime, According to Sophos Research

Sophos, a global leader in innovating and delivering cybersecurity as a service, has released two reports about the use of AI in cybercrime.

The first report—“The Dark Side of AI: Large-Scale Scam Campaigns Made Possible by Generative AI”—demonstrates how, in the future, scammers could leverage technology like ChatGPT to conduct fraud on a massive scale with minimal technical skills.

However, a second report, titled “Cybercriminals Can’t Agree on GPTs,” found that, despite AI’s potential, rather than embracing large language models (LLMs) like ChatGPT, some cybercriminals are skeptical and even concerned about using AI for their attacks.

The Dark Side of AI

Using a simple e-commerce template and LLM tools like GPT-4, Sophos X-Ops was able to build a fully functioning website with AI-generated images, audio, and product descriptions, as well as a fake Facebook login and fake checkout page to steal users’ login credentials and credit card details.

The website required minimal technical knowledge to create and operate, and, using the same tool, Sophos X-Ops was able to create hundreds of similar websites in minutes with one button.

“It’s natural—and expected—for criminals to turn to new technology for automation. The original creation of spam emails was a critical step in scamming technology because it changed the scale of the playing field. New AIs are poised to do the same; if an AI technology exists that can create complete, automated threats, people will eventually use it. We have already seen the integration of generative AI elements in classic scams, such as AI-generated text or photographs to lure victims.

“However, part of the reason we conducted this research was to get ahead of the criminals. By creating a system for large-scale fraudulent website generation that is more advanced than the tools criminals are currently using, we have a unique opportunity to analyze and prepare for the threat before it proliferates,” said Ben Gelman, senior data scientist, Sophos.

Cybercriminals Can’t Agree on GPTs

For its research into attacker attitudes towards AI, Sophos X-Ops examined four prominent dark web forums for LLM-related discussions. While cybercriminals’ AI use appears to be in its early stages, threat actors on the dark web are discussing its potential when it comes to social engineering.  Sophos X-Ops has already witnessed the use of AI in romance-based, crypto scams.

In addition, Sophos X-Ops found that many posts were related to compromised ChatGPT accounts for sale and “jailbreaks”—ways to circumvent the protections built into LLMs, so cybercriminals can abuse them for malicious purposes. Sophos X-Ops also found ten ChatGPT-derivatives that the creators claimed could be used to launch cyber-attacks and develop malware. However, threat actors had mixed reactions to these derivatives and other malicious applications of LLMs, with many criminals expressing concern that the creators of the ChatGPT imitators were trying to scam them.

“While there’s been significant concern about the abuse of AI and LLMs by cybercriminals since the release of ChatGPT, our research has found that, so far, threat actors are more skeptical than enthused. Across two of the four forums on the dark web we examined, we only found 100 posts on AI. Compare that to cryptocurrency where we found 1,000 posts for the same period.

“We did see some cybercriminals attempting to create malware or attack tools using LLMs, but the results were rudimentary and often met with skepticism from other users. In one case, a threat actor, eager to showcase the potential of ChatGPT inadvertently revealed significant information about his real identity. We even found numerous ‘thought pieces’ about the potential negative effects of AI on society and the ethical implications of its use. In other words, at least for now, it seems that cybercriminals are having the same debates about LLMs as the rest of us,” said Christopher Budd, director, X-Ops research, Sophos.

GrassRoots.ng is on a critical mission; to objectively and honestly represent the voice of ‘grassrooters’ in International, Federal, State and Local Government fora; heralding the achievements of political and other leaders and investors alike, without discrimination. This daily, digital news publication platform serves as the leading source of up-to-date information on how people and events reflect on the global community. The pragmatic articles reflect on the life of the community people, covering news/current affairs, business, technology, culture and fashion, entertainment, sports, State, National and International issues that directly impact the locals.

GRTech

Sophos Named Customers’ Choice for Endpoint Protection Platforms (EPP) by Gartner

Sophos Achieved a 4.8/5.0 Rating for Both Categories and Rated as a Customers’ Choice for all Available Segments Within the Reports

Published

on

Sophos Intercept X

Sophos, a global leader of innovative security solutions for defeating cyberattacks, today announced it has been named Customers’ Choice in the Gartner Peer Insights Voice of the Customer for Endpoint Protection Platforms (EPP) and Network Firewalls reports.

This achievement includes 4.8/5.0 scoring ratings in both categories. Sophos is also rated a Customers’ Choice for all available segments within the two reports.

“Winning one Gartner Customers’ Choice is a great achievement, but winning two in crucial interrelated categories is incredible and a strong reflection of our relentless focus to deliver optimal security outcomes for our customers,” said Rob Harrison, senior vice president, Product Management – SecOps and Endpoint Security. “Endpoint protection that works seamlessly with network security is a winning formula to defend against today’s innovative and persistent adversaries who are consistently devising new techniques to carry out ransomware and other potentially business-ending cyberattacks. This synergy enhances threat detection, reduces response times, and simplifies management, ultimately fortifying organizations against complex cyber threats that require proactive prevention and automated interventions at multiple points on the attack chain.”

Sophos Intercept X customer quotes from the endpoint protection platforms report include:

  • “Sophos endpoint provides the most robust anti ransomware protection in the industry,” IT manager in the manufacturing industry.
     
  • “Sophos endpoint protection combines multiple prevention techniques to reduce the attack,” IT manager in the education industry.

  • “Intercept X provides us protection against various cyber threats using its combination of signature-based, behavioral and machine learning methods enduring protection against malware, ransomware and other malicious activities,” network and security engineer in the manufacturing industry.

  • “It’s a great experience to work with Sophos Intercept X due to its robustness and unparalleled capability against any exploits and ransomware. It is truly amazing that this product works seamlessly while handling any threats at the system end,” manager in the media industry.

Sophos Firewall customer quotes from the network firewall report include:

A complimentary copy of the Gartner Peer Insights Voice of the Customer: Endpoint Protection Platforms report is available here.

A complimentary copy of the Gartner Peer Insights Voice of the Customer: Network Firewalls report is available here.

Continue Reading

GRTech

Ransomware Recovery Costs for Energy and Water Sectors Rise to $3m in 1 Year, Sophos Survey Finds

49% of Ransomware Attacks Against These 2 Critical Infrastructure Sectors Started with an Exploited Vulnerability

Published

on

Sophos’ Annual State of Ransomware

Sophos, a global leader of innovative security solutions for defeating cyberattacks, today released a sector survey report, “The State of Ransomware in Critical Infrastructure 2024,” which revealed that the median recovery costs for two critical infrastructure sectors, Energy and Water, quadrupled to $3 million over the past year.

This is four times higher than the global cross-sector median. In addition, 49% of ransomware attacks against these two critical infrastructure sectors started with an exploited vulnerability.

Data for the State of Ransomware in Critical Infrastructure 2024 report comes from 275 respondents at energy, oil and gas, and utilities organizations, which fall under the Energy and Water sectors of CISA’s 16 defined critical infrastructure sectors.

The results for this sector survey report are part of a broader, vendor-agnostic survey of 5,000 cybersecurity/IT leaders conducted between January and February 2024 across 14 countries and 15 industry sectors.

“Criminals focus where they can cause the most pain and disruption so the public will demand quick resolutions, and they hope, ransom payments to restore services more quickly. This makes utilities prime targets for ransomware attacks. Because of the essential functions they provide, modern society demands they recover quickly and with minimal disruption,” said Chester Wisniewski, global Field CTO.

“Unfortunately, public utilities are not only attractive targets but vulnerable to attacks on many fronts, including the requirement for high availability and safety, as well as an engineering mindset focused on physical security. There’s a preponderance of older technologies configured to enable remote management without modern security controls like encryption and multifactor authentication. Like hospitals and schools these utilities are frequently operating with minimal staffing and without the IT staffing required to stay on top of patching, the latest security vulnerabilities and the monitoring required for early detection and response.”

On top of growing recovery costs, the median ransom payment for organizations in these two sectors jumped to more than $2.5 million in 2024—$500,0000 higher than the global cross-sector median.

The Energy and Water sectors also reported the second highest rate of ransomware attacks. Overall, 67% of the organizations in these sectors reported being hit by ransomware in 2024, in comparison to the global, cross-sector average of 59%.

Other findings from the report include:

  • The energy and water sectors reported increasingly longer recovery times. Only 20% of organizations hit by ransomware were able to recover within a week or less in 2024, compared to 41% in 2023 and 50% in 2022. Fifty-five percent took more than a month to recover, up from 36% in 2023. In comparison, across all sectors, only 35% of companies took more than a month to recover
  • These two critical infrastructure sectors reported the highest rate of backup compromise (79%) and the third highest rate of successful encryption (80%) when compared to the other industries surveyed

“This once again shows that paying ransom payments almost always works against our best interests. An increasing number (61%) paid the ransom as part of their recovery, yet the amount time it took to recover was extended. Not only do these high rates and amounts of ransoms encourage more attacks on the sector, but they are not achieving the claimed goal of shorter recovery times,” said Wisniewski.

“These utilities must recognize they are being targeted and take proactive action to monitor their exposure of remote access and network devices for vulnerabilities and ensure they have 24/7 monitoring and response capabilities to minimize outages and shorten recovery times. Incident response plans should be planned in advance, the same as for fires, floods, hurricanes and earthquakes, and be rehearsed on a regular schedule.”
Read the full State of Ransomware in Critical Infrastructure on Sophos.com.

Continue Reading

GRTech

SHELT SI Achieves Cisco Select Partner Certification

Published

on

SHELT and CISCO

SHELT System Integration (SHELT SI) has announced its achievement of Cisco Select Partner certification in Nigeria, marking a significant milestone in its commitment to delivering top-tier networking and security solutions to businesses across the region.

This certification underscores SHELT SI’s dedication to excellence in providing innovative networking and security solutions tailored to meet the evolving needs of the market.

The Cisco Select Partner certification is a validation of SHELT SI’s technical expertise and commitment to customer satisfaction, as well as its ability to deliver cutting-edge networking and security solutions that drive business success. With this recognition, SHELT SI is affirming its ability to further enhance its offerings and support its clients in navigating the complexities of the digital landscape.

Cisco Nigeria General Manager Sebastine Nzeadibe comments: “We are delighted to welcome SHELT SI to the ranks of Cisco Select Partners in Nigeria. Their demonstrated commitment to excellence and customer satisfaction aligns perfectly with our values, and we look forward to collaborating closely together to empower businesses with transformative networking and security solutions.”

Youssef Abillama, CEO of SHELT, comments: “Achieving this certification strengthens our relationship with CISCO and is a testament to our team’s dedication and expertise in delivering best-in-class solutions. This milestone reinforces our commitment to empowering businesses in Nigeria with innovative technology solutions that will enable them to thrive in the digital age through cutting-edge technology solutions.”

SHELT’s Country General Manager, Walid Bou Abssi, added, “The Cisco Select certification empowers us to provide an increased level of support and further enhances our ability to address the requirements of our clients’ evolving needs in Nigeria. It is an acknowledgement of the ability of our pre-sales, sales, and client support teams to design, quote, deploy, and support Cisco solutions.”

Continue Reading

Trending