As per a recent report by BlackBerry, it was revealed that critical infrastructure providers faced a surge in cyberattacks during the latter part of 2023. Shockingly, these providers bore the brunt of 62% of all industry-related cyberattacks tracked from September through December. What’s more concerning is the 27% increase in the use of novel malware during this period, indicating a deliberate effort by threat actors to circumvent traditional defense mechanisms. With over 5,300 unique malware samples targeting BlackBerry’s customers daily, the urgency for enhanced cybersecurity measures becomes evident.

Threat actors are not only leveraging novel malware but also exploiting critical vulnerabilities in widely used products such as Citrix Netscaler, Cisco Adaptive Security Appliance, and JetBrains TeamCity. By exploiting these vulnerabilities, threat groups can infiltrate targeted organisations, posing a substantial risk to their operations. Additionally, VPN appliances remain highly attractive targets for state-linked threat actors, further stressing the need for heightened security measures across all sectors.

The backdrop of rising geopolitical tensions, including Russia’s invasion of Ukraine and escalating conflicts in the Asia-Pacific region, adds another layer of complexity to the situation. U.S. authorities have already issued warnings regarding the increased threat to critical infrastructure providers, particularly from state-sponsored groups like Volt Typhoon, with ties to the People’s Republic of China. These groups aim to disrupt essential services, potentially causing mass panic and diverting attention from other geopolitical agendas.

Ismael Valenzuela, VP of threat research and intelligence at BlackBerry, underscored the gravity of the situation, stating, “The end goal of attacks, whether from financially motivated attackers or nation states, is to cause havoc.” Organisations operating in critical infrastructure sectors understand the urgency to mitigate these threats promptly, often resorting to quick payments to restore operations.

Moreover, the report highlights the growing trend of attacks exploiting vulnerable VPN devices to gain unauthorised access to critical industries. Additionally, specific malware families like PrivateLoader, RisePro, SmokeLoader, and PikaBot have witnessed increased usage, further complicating cybersecurity efforts.

This spike in cyberattacks targeting critical infrastructure demands immediate attention from stakeholders worldwide. As threat actors continue to evolve their tactics, it is imperative for organisations to prioritise cybersecurity measures and stay cautious against emerging threats. Failure to do so could have severe implications not only for individual institutions but also for the stability of essential services and national security.