Cybercrime has become an ever-growing threat to businesses of all sizes in today's digital age. Particularly alarming is the fact that cyberattacks frequently target small and medium-sized enterprises, which are often unprepared for such security breaches. These businesses often find themselves in a difficult position, as they are frequently an easy target for cybercriminals. In the event of a cyberattack, the consequences can be devastating: data is encrypted, stolen, or deleted, and the affected companies often face ransom demands. This dynamic highlights the urgent need for businesses to reconsider and strengthen their cybersecurity strategies to protect themselves against this growing threat.

The most important points in brief

• Many companies today face a growing number of complex cyberattacks.
• The ongoing digitalization and increasing interconnectedness are expanding the attack surfaces – and these are being exploited.
• Cyberattacks using malware are employed through email attachments, for example, and enable various types of attack scenarios.
• Defending against cyberattacks is crucial to protect both personal and business data from potential threats.

Professionalization of cybercrime

In his annual report The Federal Office for Information Security (BSI) provides a detailed insight into the current threats in cyberspace regarding the state of IT security in Germany. The report for the year 2023 concludes that the danger in the field of cybersecurity has reached an unprecedented level.

In cybercrime, a steady progression of division of labor and professionalization among cybercriminals is being observed, which is manifesting in a growing service-oriented character.

Today, for example, there is a range of Phishing as a Service (PhaaS) providers that offer a variety of services for cybercriminals. These range from the creation and sending of phishing emails to the management of forwarding websites and the final lure pages, as well as technical support and step-by-step tutorials. Often, ready-made phishing pages are offered for well-known online services such as Google, Microsoft, LinkedIn, iCloud, Facebook, Twitter, Yahoo, WordPress, and Dropbox. Additionally, there is the option to develop custom phishing pages for specific attack targets upon special request.

Phishing proxy services are also widespread, acting as a man-in-the-middle (MITM) between the victim and a service's login page. These can be capable of stealing credentials and cookies, and even bypassing security measures like multi-factor authentication.

A disturbing example of such a service is EvilProxy. Particularly alarming is that in addition to phishing pages for common services like Google and Microsoft, EvilProxy also offers them for critical developer platforms such as the Python Package Index (an official directory for Python software), npmjs (a JavaScript package manager used by millions of developers), and GitHub (a platform for software developers). A successful attack on such sites could lead to supply chain attacks by maliciously modifying or cloning code repositories, which in turn could infect legitimate software with malicious data-stealing programs.

In summary, phishing remains an effective way for attackers to gain access to IT networks. With the mentioned PhaaS services, even less experienced attackers with limited resources can carry out phishing attacks, which is likely to significantly influence the evolution of phishing. In addition, phishing activities have diversified and now include attacks via social media, SMS, and phone calls.

The growing danger of ransomware

A ransomware attack is a form of digital extortion. Attackers exploit various vulnerabilities such as human error, configuration flaws, outdated software, or insufficient data backups to infiltrate systems and encrypt data. The attackers then demand a ransom for the release of the encrypted data. This demand is often accompanied by the threat of publishing previously stolen data. This approach is also known as double extortion. In such cases, the ransom often serves to buy the victims' silence. The demanded payment is usually made in digital currencies like Bitcoin or Monero.

Ransomware attacks now account for a significant portion of data breaches. These types of cyberattacks often lead to a high risk for the rights and freedoms of the individuals affected, as well as enormous economic damage for the attacked organization. Demands for millions in ransom are no longer uncommon – the perpetrators are well aware of the businesses' predicament. While data encryption alone used to be the hallmark of these attacks, data exfiltration and publication of this data now represent a major challenge for attacked businesses. Even if a resumption of operations is possible in such cases through backups and other precautions, the data has irrecoverably fallen into the hands of criminals who are specifically extorting money or pursuing other malicious intentions.

Through cyber prevention measures, companies can tighten their IT security network and make it more difficult for ransomware groups to continue their business model. The measures described below are intended to encourage early action and thus provide adequate protection.