Cybercriminals are more and more turning to freelance penetration testers to enhance the effectiveness of ransomware assaults and to search out new avenues for intrusion, in line with new analysis from IT consultancy agency Northdoor.
Many organisations flip to third-party IT consultants for penetration testing to establish vulnerabilities inside their very own methods. These consultants can present an entire overview of an organisation, providing a complete assessment of the place weaknesses exist.
However now, cybercriminals are utilizing this service in opposition to the very organisations it was created to assist shield. Cybercriminals wish to make sure that their ransomware will be deployed efficiently in opposition to an organisation. Analysis has proven that malware writers are scouring the darkish net seeking to recruit educated, freelance penetration testers (or crimson hat hackers) to check their malware payloads on a number of digital methods for its effectiveness.
Pink hat hackers are then in a position to advise malware operators on attainable weak factors which they’ll use to interrupt into networks and finally compromise knowledge for ransomware extortion.
This enterprise mannequin has been so efficient that malware is now being supplied as a part of an affiliate programme. Every affiliate is liable for putting in and finishing up assaults themselves, whereas the ransomware group takes a proportion of the payout.
AJ Thompson, CCO at Northdoor, explains the challenges penetration testing can current: “Organisations flip to freelance white hat hackers to show their community vulnerabilities and to assist guarantee they’ll enhance their safety posture. The truth that many of those freelance white hat hackers might be tempted to show crimson for the appropriate worth, is extremely regarding.
“Probably this might lead to assault strategies turning into more durable to detect and the creation of a worst-case state of affairs by which new ransomware is deployed earlier than cybersecurity specialists get the prospect to analyse and mitigate it.
Beating cybercriminals to the punch
With the worldwide penetration testing market valued at $2.20billion in 2023 with it projected to develop from $2.45billion in 2024 and attain $6.35billion by 2032, it’s no shock that in any other case authentic freelance penetration testers (or white hat hackers) might be recruited into crimson hat exercise ought to ransomware gangs supply a greater worth.
Thompson provides: “Firms are extra reliant than ever on know-how for his or her day-to-day operations. Consequently, there are extra factors of entry for cybercriminals to benefit from and if compromised it will possibly have a devastating impression on the power to proceed working.
“All organisations and their companions and suppliers want to grasp that simply because defence methods have been beforehand validated doesn’t essentially imply they’re safe now. Fairly merely, they can not afford to downgrade their cybersecurity efforts. Nonetheless, with many dealing with price range restraints and understaffing, rigorously assessing companions, suppliers and methods will not be one thing that may be undertaken in-house.
“Turning to third-party IT consultancies which have the expertise and experience to advise on essentially the most applicable cyber defences after which implement and handle them is significant. This enables smaller IT in-house groups to concentrate on different, essential enterprise features, while having peace of thoughts that the safety is within the fingers of a proactive and skilled workforce.
“Third-party IT consultants can permit organisations to have pressing conversations with companions and suppliers to shut the vulnerabilities earlier than they’re exploited by cybercriminals.
“Ransomware assaults are extraordinarily profitable and due to this fact aren’t going to go away any time quickly. Getting forward of any future assaults utilizing AI, automation and risk intelligence will likely be essential for organisations. Efficient prevention, detection and response applied sciences carried out by third-party IT consultants, will allow organisations to proactively defend in opposition to an assault,” concluded Thompson.
