📋 Tender Overview
Hackers are increasingly attacking the resources of medium-sized businesses in various Russian regions. They scan sites with automated IT tools in search of vulnerabilities.
The number of information security (IS) events from automated scanners in the first half of 2024 increased compared to the second half of last year.
Changing the choice of victims
Hackers have begun to attack online resources of medium-sized businesses in different regions of Russia more often. This was reported to Izvestia in mid-October 2024 by experts from the Web Application Firewall (WAF) service of the Russian Solar Group of Companies. Information security analysts have recorded an increase in DDoS attacks on small companies located in the Volga region, Siberia and the Urals.
In the first half of 2024, the number of information security events related to the activity of automated scanners increased by 2.2 times compared to the last half of 2023. Vulnerability scanning is a procedure for scanning applications, IT systems, devices or networks for potential security vulnerabilities. Cybercriminals use weaknesses in software and systems to penetrate organizations' networks in order to carry out cyberattacks. The process itself helps to detect and classify weaknesses in companies' networks and IT systems. Currently, hackers are looking for vulnerabilities in web applications that allow attacks such as SQL injections, Cross Site Scripting (XSS) or cross-site scripting, and path traversal to be carried out.
SQL injection is a web security vulnerability that allows a hacker to interfere with the queries an application makes to its database. XSS is a type of computer system vulnerability that allows a hacker to inject arbitrary code into an HTML page generated by server-side scripts. Path traversal is a cyber attack in which an attacker attempts to access files outside of normal directories by manipulating file paths.
According to Alexey Pashkov, Head of WAF and Anti-DDoS at Solar Group, hackers scan up to 97% of websites with automated IT tools to search for vulnerabilities, so even inconspicuous websites become a target for attackers. The hackers themselves, for example, can practice before larger-scale targeted cyberattacks on large, well-known web portals.
Although hackers from Russia reuse codes for IT attacks, they do not share them among themselves. Different families of malware (MW) do not have a single framework, libraries or similar IT tools. Each hacker group has its own separate team that has been developing similar MW tools for many years. This is what creates a large selection of them on the market of software for carrying out cyber attacks. This situation is beneficial for hackers, because the risk of all other IT attacks being exposed in the event of failure of one of them is reduced due to the fact that successful information security protection from each individual cyber attack can increase the overall security of the IT system. This can be achieved by improving security protocols, training information security employees and introducing more reliable technologies, which in turn reduces the likelihood of other IT incidents and makes it more difficult for attackers to access the system of the selected target.
Rise in DDoS attacks
Information security analysts from the Solar Space cloud cyber defense platform in the Solar group of companies also recorded an increase in DDoS attacks on small companies located in the Volga region, Siberia and the Urals.
According to Artem Izbaenkov, Director of the Solar Space platform, if previously hackers were interested in large companies in the Central Federal District (CFD), now the trend has shifted to representatives of small and medium businesses in other regions of Russia. Since hackers from Russia have such a large number of information resources and competencies, they will increase the intensity and depth of cyberattacks, and this means investing millions of dollars in "offensive operations" in cyberspace. Attackers have begun to use more complex and multifunctional DDoS attacks, in which several types of threats are used simultaneously, the expert reports. This complicates both the protection of organizations from hacker attacks and the process of eliminating the consequences of IT attacks. Small businesses are becoming especially vulnerable, which sometimes lack the resources for high-quality cyber defense due to the high prices of the relevant solutions.
According to Solar Space, hackers will see an increase in their use of illegally rented computing power in 2024. Traditional botnets formed from infected Internet of Things (IoT) devices are becoming less effective, as devices such as smart refrigerators and surveillance cameras do not have enough power to launch attackers. Hackers have begun to resort to the practice of renting servers and virtual machines in Russian data centers. This gives them access to more powerful resources, and also allows attackers to significantly enhance their IT attacks and avoid geographic filters that many companies use in their security measures.
Russian organizations, including small and medium businesses, need to constantly upgrade their cybersecurity measures, implement multi-layered protection, and regularly conduct audits for IT vulnerabilities. For smaller companies, it is especially important to consider cloud services that can combine several IT cybersecurity tools. At the same time, geopolitical tensions in connection with the special military operation (SMO) of Russia in Ukraine are only growing, it will continue to affect the Russian IT sector. In the context of constantly changing cyber threats, this approach can help minimize risks and reduce potential damage from DDoS attacks to a minimum.
