Cyber Extortionists Set Sights on APAC
Undoubtedly, the Asia-Pacific and emerging markets provide a wealth of business opportunities. Unfortunately, this makes them attractive targets for cybercriminals looking to exploit them for financial gain.
Orange Cyberdefense, the cybersecurity arm of telecom company Orange Group, released its annual security research report highlighting that cyber extortion continues to dominate the cybercrime landscape.
The Security Navigator 2023's in-depth analysis examined 99,506 potential incidents investigated and triaged by Orange CyberSOC teams.
The report revealed that cyber extortion incidents increased by 78% from last year, with 82% of observed victims being small businesses. Notable spikes in the news about ransomware occurred in March and April 2022, resulting from Lapsus$ activity and Conti leak events, as well as concerns about the war on Ukraine.
While cyber extortion remains the dominant form of attack, victim location is shifting from North America towards Europe, Asia and emerging markets. Cy-X victim volumes decreased by 8% in North America and 32% in Canada but increased in the European Union by 18%, in the U.K. by 21%, and by 138% in the Nordics. East Asia saw an increase of 44% in cyber extortion incidents, and Latin America, 21%. Over the last six months, the number of Cy-X victims in Southeast Asia grew by 33%.
The Security Navigator 2023 report also found dramatic shifts in the makeup of active criminal groups. Of the top 20 actors observed in 2021, 14 are no longer in the top 20 in 2022. After Conti disbanded in Q2 2022, Lockbit2 and Lockbit3 became the most prominent Cyber Extortion actors in 2022, with over 900 victims combined.
Almost 90% of all the cyber criminals claimed victims in the U.S. In comparison, more than 50% targeted the U.K. Additionally, more than 20% of actors even hit Japan — a country with one of the smallest numbers of observed victims in Orange Cyberdefense's dataset.
Another highlight of the report was the vulnerability of SMEs to cyber extortion. The report showed that about 4.5x more small businesses fell victim to cyber extortion than medium and large businesses combined.
Small-to-medium-sized businesses reflected 49% of confirmed incidents this year (compared to 10% in 2019, 24% in 2020 and 35% in 2021). With average data breach costs estimated at USD1.9 million for businesses with less than 500 employees, SMEs may face the risk of going under due to these breaches.
"This year's results highlight the challenges faced by organizations of all sizes. Threats are evolving, becoming more complex, coming from all directions and underlining the importance of the work we will continue to do to adapt to the threat and support our customers in this fight," concluded Hugues Foulon, chief executive officer of Orange Cyberdefense.
Image credit: iStockphoto/Diy13
