Cybersixgill Releases Annual State of the Underground Report, Revealing Dark Web Threat Actor Activities and Behaviors in 2023

Cybersixgill, cyber threat intelligence data provider, announced recently its newest report, State of the Underground 2024, which analyzes the company’s collected intelligence from the clear, deep, and dark web in 2023. The report features insights from the company’s threat intelligence experts into underground cybercriminal discourse, tactics, and behaviors, comparing them with trends and data from previous years and revealing the current state of threat actors’ activities and targets.

State of the Underground delves into several key topics, including:

Compromised credit card trends
Physical products on the underground
Messaging platforms and underground forums
Vulnerabilities and exploits
Initial access trends
Malware and ransomware trends

“Our expert threat analysts collect and analyze 10 million intelligence items daily from the deep and dark web,” said Dov Lerner, Security Research Lead at Cybersixgill. “With the breadth and depth of our intelligence and Cybersixgill’s powerful AI and machine learning capabilities, we can continually monitor the cybercriminal underground and analyze evolving trends.

“While advances in threat intelligence and cybersecurity, more stringent regulation, and stepped-up law enforcement activities are putting a dent in cybercriminals’ efforts, malicious actors are focusing their efforts on tactics and targets that generate the greatest return,” he continued. “Organizations that combine broad visibility into hard-to-reach sources with automated analysis gain an important advantage in the ongoing battle to protect their people and assets.”

Significant Findings: A Mix of Good News and Bad News

Credit Card Fraud: A Slight Increase in 2023, But Still on the Decline

Over the past five years, underground markets for compromised credit cards have declined due to improved fraud prevention. However, there was a 25% rebound in 2023, reaching 12,022,455 cards (still far fewer than the more than 140 million compromised cards detected for sale in 2019). This slight increase notably occurred in the last two months of the year, so it remains to be seen if it will continue into 2024. Organizations must remain vigilant despite overall trends and evolving threat landscapes.

Less Chatter on Messaging Platforms and Underground Forums

Threat actors have recently shifted from underground forums to messaging platforms like Telegram. Still, in 2023, both areas saw significant declines, which could be tied to a 50% drop in right-wing extremist forum activity. The top 10 forums experienced a 50.3% decrease in participating threat actors as law enforcement’s disbandment of major forums like RaidForums and BreachForums had an impact.

Fewer New Vulnerabilities, But Still a Significant Threat

In 2023, despite a small rise in the number of new vulnerabilities added to the National Vulnerability Database (NVD), the pace has slowed compared to previous years. Between 2022-2023, there were 5.4% more new vulnerabilities added to the NVD, compared to 36.1% between the period 2021-2022. However, while there was a decrease in the number, the impact and number of attacks were not less substantial than in previous years.

Stealer Malware: Newer Types Outperformed by the Oldtimers

Over the past few years, stealers, a type of malware that gathers valuable data like credentials from infected systems, have increased in popularity. Market listings track which stealers compromise systems, revealing trends. In 2023, threat actors used four new types of stealer malware in large numbers - Stealc, Risepro, Lumma, and Silencer. Nevertheless, incumbents like Raccoon and Vidar remained popular, highlighting the resilience and effectiveness of established stealers against new competitors.

Initial Access Trends: Compromised Access and Domains on the Rise

Last year, the wholesale trading of remote desktop protocol (RDP) ports ceased entirely due to the closure of some prominent underground markets. However, the listings of compromised endpoints – a crucial entry for threat actors to gain a foothold in an organization’s systems to launch ransomware and other attacks – rose by a massive 88%. Compromised domains also rose by 17% compared to 2022, continuing a trend of steady increases in domain compromise.

Ransomware: Fewer Attacks Generate Bigger Payouts

In 2023, Cybersixgill reported a 9.2% decrease in ransomware attacks, with the top five groups responsible for 65% of incidents. Despite the decline, attacks have grown more targeted and sophisticated, with average payouts soaring in the millions of dollars. While the ransomware group LockBit dominated, other groups continued consolidating, with a 30% reduction in active groups. At the same time, there was a continued rise in ransomware-as-a-service offerings, lowering the entry barriers for less sophisticated threat actors. The U.S. and UK remained prime targets, highlighting the global ransomware threat.

Featured

  • 7 Reasons Why Governments Need to Regulate AI

    Recently, Elon Musk unveiled two remarkable AI applications. A humanoid robot named Optimus, with its remarkable human-like speech and movements, and a fully autonomous car, absent steering wheel and pedals, called Cybercab. While these examples represent a broad trend of AI integration across industries, they highlight technology’s transformative potential, prompting a need for regulation to ensure it is used responsibly, securely and ethically. Read Now

  • OR Code Phishing on the Rise According to New Report

    KnowBe4 recently released its Q3 2024 Phishing Report. This quarter's findings reveal the most frequently clicked email subjects in simulated phishing tests, demonstrating the continued efficacy of HR and IT-related phishing attempts. KnowBe4’s Q3 2024 Phishing Report reveals that HR and IT-related phishing emails claim a significant 48.6% share of top-clicked phishing types globally. Despite evolving techniques by bad actors, phishing emails remain among the most prevalent tools for executing cyberattacks. Read Now

  • United HealthCare CEO Killed in Targeted Attack in New York City

    United HealthCare CEO Brian Thompson was killed in a targeted attack early Wednesday in Manhattan Read Now

  • Theft, Crime Driving Retail Workers to Look for New Jobs

    More than four in ten retail workers in the U.S. say they are likely to leave their current job in the next 12 months due to personal safety concerns, according to new research conducted by the Loss Prevention Research Council (LPRC) in partnership with Verkada. Read Now

Featured Cybersecurity

Webinars

New Products

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3