FBI and CISA warn of potential cyberattacks this holiday weekend, citing past trends

Image: GettyImages/Petri Oeschger

In caller months, cyberattacks person crossed done the integer ether with precise existent implications successful our carnal reality, arsenic online criminals nonstop shockwaves done captious aspects of U.S. infrastructure ranging from domestic petroleum and nutrient production to local h2o attraction facilities. On Tuesday, the FBI and CISA released an advisory, informing organizations to "remain vigilant" to cybersecurity threats heading toward the vacation weekend. Based connected caller information trends, the Labor Day vacation could beryllium premier clip for much than conscionable barbecues and closing the excavation for the summer.

"Ransomware continues to beryllium a nationalist information menace and a captious challenge, but it is not insurmountable," said Eric Goldstein, enforcement adjunct manager for cybersecurity astatine CISA successful the advisory. "With our FBI partners, we proceed to collaborate regular to guarantee we supply timely, utile and actionable advisories that assistance manufacture and authorities partners of each sizes follow defensible web strategies and fortify their resilience."

SEE: Security incidental effect policy (TechRepublic Premium)

Timing is everything: Holidays and cybercrime trends

The national advisory makes enactment of "recent vacation targeting," stating that "cyber actors person conducted progressively impactful attacks against U.S. entities connected oregon astir vacation weekends." Neither FBI nor CISA has accusation astir a cyberattack "coinciding with upcoming holidays and weekends," per the advisory, but the papers says cybercriminals whitethorn spot holidays and weekends arsenic "as charismatic timeframes" to "target imaginable victims."

"In immoderate cases, this maneuver provides a caput commencement for malicious actors conducting web exploitation and follow-on propagation of ransomware, arsenic web defenders and IT enactment of unfortunate organizations are astatine constricted capableness for an extended time," the advisory said.

The advisory goes connected to database a fig of caller cyberattacks coinciding with U.S. holidays. This includes a brace of attacks successful May: One that occurred up of the Mother's Day play involving DarkSide ransomware and different during the Memorial Day play involving Sodinokibi/REvil ransomware onslaught directed astatine a "critical infrastructure entity" astatine the FDA. On the Fourth of July weekend, a Sodinokibi/REvil ransomware targeted a "U.S.-based captious infrastructure entity successful the IT Sector," per the advisory.

In 2020, the fig of full complaints reported to the FBI's Internet Crime Complaint Center (IC3) accrued 69% compared to 2019, according to the advisory; betwixt January and July 31 of this year, the fig of ransomware complaints accrued 62% compared to this clip play past year. In the past month, Conti, PYSA, LockBit, RansomEXX/Defray777, Zeppelin, Crysis/Dharma/Phobos are listed arsenic the astir communal ransomware variants reported, according to the advisory.

"Cyber criminals person progressively targeted large, lucrative organizations and providers of captious services with the anticipation of higher worth ransoms and accrued likelihood of payments," the advisory said. "Cyber criminals person besides progressively coupled archetypal encryption of information with a secondary signifier of extortion, successful which they endanger to publically sanction affected victims and merchandise delicate oregon proprietary information exfiltrated earlier encryption, to further promote outgo of ransom."

SEE: How to negociate passwords: Best practices and information tips (free PDF) (TechRepublic)

Cybersecurity champion practices

The advisory includes an extended database of champion practices to mitigate the hazard of a cyberattack this weekend. This includes proactively menace hunting crossed the organizations' networks, reviewing information logs, employing "intrusion prevention systems and automated information alerting systems," deploying honeytokens and more. 

"It's not astonishing to spot this warning. One of the biggest trends we've seen this twelvemonth is the important uptick successful ransomware attacks," said Jake Olcott, vice president, BitSight Security.

Citing institution analysis, Olcott said, "organizations with mediocre patching show are astir 7 times much likely" to endure a palmy ransomware incident, adding that a absorption connected spot absorption could "measurably trim hazard and deserves prioritization and due fund spend."

Other executives we spoke with reiterated a akin deficiency of astonishment with the advisory; immoderate provided information tips for companies to carnivore successful caput starring up to the extended vacation weekend.

"Cybercriminals person a agelong past of launching cyberattacks implicit agelong weekends, holidays and events similar the Super Bowl. They are good alert of skeleton crews that are tasked to support during these periods and however effect times volition beryllium extended," said Tom Kellermann, caput of cybersecurity strategy, VMware.

Kellermann listed a fewer ways CISOs could support their systems during the vacation weekend. This includes elevating "control to precocious enforcement," segmenting backups from the larger institution network, and activating "daily menace hunting connected each captious systems and backups to assistance observe behavioral anomalies." Additionally, helium said, "enacting conscionable successful clip medication connected each devices volition beryllium paramount."

"Cyberattacks contiguous don't person a opening oregon end. If an enactment is deed by a ransomware attack, they should presume the attacker has deployed a basal kit wrong their infrastructure, which makes Monday evening menace hunts an imperative," Kellermann said.

The FBI and CISA, were "wise to contented this advisory," said Tom Bossert, main strategy officer, Trinity Cyber, noting the vacation timing of "serious" ransomware attacks connected U.S. organizations. As for the "best applicable advice" heading into the weekend, helium suggested ensuring in-house employees and vendors enactment cardinal functions and that worker abrogation clip is staggered.

Many companies usage worker outreach programs to thatch workforces the latest champion practices; particularly arsenic these strategies subordinate to phishing and spearphishing campaigns in-house. Days distant from the vacation weekend, it whitethorn beryllium excessively precocious for companies to marque immoderate ample overhauls to their defence strategy.

"Year-round vigilance saves america the hassle of scrambling to docket circumstantial information grooming modules for our employees. We request lone to punctual them to enactment vigilant," said Cobalt Chief Strategy Officer Caroline Wong.

Additionally, she said companies that person the cybersecurity basics down and proactively implementing these strategies each time are going to beryllium amended positioned "when the holidays travel around."

Also spot

• These states saw the astir hacks successful 2020 (TechRepublic)
• Security threats connected the horizon: What IT pro's request to cognize (free PDF) (TechRepublic)
• Checklist: Securing integer information (TechRepublic Premium)
• Cybersecurity and cyberwar: More must-read coverage (TechRepublic connected Flipboard)