APT Attack Trend Predictions for 2023: The Next WannaCry is Just Around the Corner!

With cyberattacks intensifying, people all over the world should be prepared at all times. Kaspersky's Global Research and Analysis Team (GReAT) saw all of its advanced threat predictions from last year confirmed, and recently, the team analyzed and predicted APT attacks for 2023.

▌The Rise of Destructive Attacks

The brutal geopolitical shifts of 2022 will have a lasting ripple effect for years to come. History shows that such tensions always translate into increased cyber activity—sometimes for intelligence gathering, sometimes as a diplomatic signal. We expect that the boiling point of conflicts will lead to unprecedented and severe cyberattacks in 2023.

Specifically, we expect to observe a record number of destructive APT attacks next year, severely impacting government sectors and critical industries. It is worth noting that a portion of these will likely be difficult to trace, with attackers creating the illusion of a "random accident," while the rest will be disguised as ransomware attacks or hacktivist operations to provide sufficient deniability for those behind the scenes.

Additionally, we are concerned that some APT attacks will target civilian infrastructure (such as energy grids or public broadcasting) as well as underwater cables and fiber optics that are difficult to defend against physical damage.

▌Mail Servers Become a Priority Target

Over the past few years, we have seen APT attackers increasingly focus on email software. These represent large software stacks that must support many protocols and must be internet-facing to function properly. Market leaders in the email space, Microsoft Exchange and Zimbra, have both faced critical vulnerabilities (pre-authentication RCE) that were heavily exploited by attackers before patches were released.

We believe that the research into mail software vulnerabilities is just beginning. Mail servers suffer double trouble, possessing critical intelligence of interest to APT attackers while offering the largest attack surface imaginable. 2023 is very likely to be a year of zero-days for all major email software. We encourage system administrators to set up monitoring systems for these machines immediately, as patching (even timely patching) may not be enough to protect them.

▌The Next WannaCry

Statistically, some of the largest and most widespread cyberattacks occur every 6 to 7 years. The most recent event traces back to the infamous WannaCry ransomware attack in 2017, which leveraged the extremely powerful EternalBlue vulnerability to spread automatically to vulnerable machines.

Fortunately, vulnerabilities capable of creating worms are rare and far between, requiring many conditions to be met for execution (exploit reliability, stability of target computers, etc.). It is hard to predict when the next one will appear, but we would boldly guess it will happen next year. One potential reason increasing the likelihood of such an event is that the world's highest-level attackers likely possess at least one suitable exploit, and current tensions significantly increase the likelihood of ShadowBrokers-style leaks and exploits occurring.

▌APT Targets Shift Towards Space Technology

It has been nearly 40 years since the US Strategic Defense Initiative (nicknamed "Star Wars") planned to extend military capabilities to include space technology. While these things seemed a bit far-fetched in 1983, several countries have successfully jammed satellites orbiting the Earth.

APT attackers have already shown they can hijack satellite communications, and if the Viasat incident is any indication, APT attackers may increasingly turn their attention to the manipulation and disruption of satellite technology in the future, making the security of such technology even more critical.

▌"Hack-and-Leak" is the New Dark

There is still much debate over whether "cyber warfare" will actually happen. But clearly, a new form of hybrid conflict is currently unfolding, which includes "hack-and-leak" operations.

This approach involves breaching targets and publicly releasing internal documents and emails. Ransomware groups have already used this tactic as a way to pressure victims, but APT attackers may exploit this tactic for purely destructive purposes. In the past, APT groups have leaked data from competing threat groups or created websites to spread personal information. While hard to evaluate from an outsider's perspective, they are undoubtedly the trend now and will see a surge of cases in 2023.

▌More APT Groups Will Shift from CobaltStrike to Other Alternatives

Released in 2012, CobaltStrike is a threat simulation tool designed to help red teams understand the methods attackers can use to penetrate networks. Unfortunately, it has become the tool of choice for cybercrime groups and APT attackers alike, alongside the Metasploit framework. However, we believe that some attackers will begin to use other alternatives.

Brute Ratel C4 is one such alternative, a highly dangerous commercial attack simulation tool designed to evade detection by antivirus and EDR protections. Another alternative is the open-source offensive tool Sliver.

In addition to off-the-shelf products abused by attackers, other tools may be included in the APT toolkit. One of these, Manjusaka, is advertised as an imitation of the CobaltStrike framework. The implants for this tool are written in Rust for Windows and Linux. A fully functional version of C&C written in Golang is freely available, making it easy to generate new implants with custom configurations. Another is Ninja, a tool that provides a large number of commands allowing attackers to control remote systems, avoid detection, and penetrate deep into target networks.

Overall, we suspect that CobaltStrike has received too much attention from defenders (particularly in terms of infrastructure), and APT groups will try to diversify their toolsets to remain undetected.

▌Signal Intelligence-Based Malware

It has been nearly 10 years since the Snowden leaks revealed the FoxAcid/Quantum hacking systems used by the NSA. They involved leveraging "partnerships with US telecom companies" to place servers at key locations on the internet backbone, allowing them to perform man-on-the-side attacks. This is one of the most powerful attack vectors imaginable because they allow victims to be infected without any interaction. Such attacks are extremely difficult to detect, but we predict they will become increasingly common in 2023.

▌Drone Hacking

Using commercial-grade drones to achieve close-range hacking. In recent years, civilian drones have made huge leaps in range and capability. It is not complicated to install a rogue Wi-Fi access point or IMSI catcher, or to carry enough tools to collect WPA handshakes used for offline Wi-Fi password cracking. Another attack scenario is using drones to drop malicious USB drives into restricted areas, hoping passersby will pick them up and plug them into their devices. In short, we believe this is a plausible attack vector that could be used by bold attackers or experts who are already adept at hybrid physical and cyber intrusions.

Some of the predictions made by the GReAT team this time align with what we have emphasized many times before: APT attack groups will not remain stagnant; they actively seek technical innovation and varied tactics, and are shifting their targets more towards critical infrastructure. The recently released "Critical Information Infrastructure Security Protection Requirements" in China also clearly requires organizations to conduct continuous offensive and defensive drills, and to adopt measures such as simulated cyberattacks to test actual protection and response capabilities. The Saixun Security Metric Validation Platform utilizes real, automated APT attack scenarios to help enterprises continuously validate the effectiveness of their security defenses, tracking internet attack groups 24/7, promptly updating attack libraries, restoring attack techniques, and providing rich validation means for various organizations and enterprises.

| References

https://securelist.com/advanced-threat-predictions-for-2023/107939/