As we are nearing the business end of 2022, the curtains are about to be pulled. we are readying ourselves to welcome he new year with cheers and hope of bringing new opportunities, the threat landscape expected to evolve and will take a new shape and direction.

TheCyberThrone will take this opportunity to go back 365 days and to review the predictions of 2022, What is been said and what is happened. In risk term evaluating the Key performance indicators against the Key Risk Indicators.

TheCyberThrone predictions and their outcomes were listed below

Prediction # 1

Mouth Watering API’s Attackers Target

What said ?

Internet of Things and 5G traffic between API services and apps will make them increasingly lucrative targets, causing unwanted exposure of information. The connected nature of APIs potentially also introduces additional risks to businesses as they become an entry vector for wider supply chain attacks. Since the authentication requirements are not interactive, they are more vulnerable. Attacks targeting APIs go undetected as they are generally considered trusted paths and lack the same level of governance and security controls. API is a connection between computers or programs that allows two applications to interact with each other.

What happened?

This year 2022, as predicted API weakness topped the threat actor list by exploiting the weakness big attacks have taken place

1. Twitter suffered multiple breaches due to API weakness
2. Log4j Vulnerabilities persisted throughout the year and gave a big headache to API Security
3. Algolia API keys – Search API leaked by multiple apps
4. LEGO API flaws leave data insecure
5. IRCTC Data breach probably occurred due to a weakness in API
6. Ecco Data breach occurred due to misconfiguration in API
7. Researchers discovered exploiting API vulnerabilities to unlock Cars
8. Spotify backstage RCE vulnerability exploited by an API weakness

Likewise, many attacks have occurred for which the weakness in API, stands as a major reason

Prediction # 2

The threat lies with Cloud Migration

What Said?

Nearly half of the organizations moved business-critical functions to the cloud as a direct result of the pandemic, cloud migration requires specific considerations that will likely be overlooked in 2022. For instance, detecting and preventing malicious activity in the cloud is a lot different, and this can be further complicated by the nuances of working with cloud providers, as well as other company stakeholders looking to rapidly adopt new services in the cloud. Unless organizations educate their entire teams, not just security teams, about securing the cloud, they will inevitably pay the price as their migration accelerates.

What happened?

• Multi-cloud adoption is accelerating with 75% of organizations using multiple providers
• 70% of organizations stored 60 % of their sensitive data in the cloud 
• 50% have experienced a data breach or failed an audit involving data and applications in the cloud
• Only 37% track and detect resource misconfigurations 
• 65% of cloud users reported not having visibility of all resources and their configurations,

Prediction # 3

Disrupting Supply Chains

What Said?

Attempts to disrupt organizations’ supply chains and the measures that can be taken against these attempts can be among the cybersecurity trends of 2022. Considering that hardware and software for improving IT infrastructure will be highly in demand in the upcoming years, it will be necessary to make the data protection and authentication process more effective to block supply chain attacks. Leveraging machine learning and artificial intelligence can be the key to making the two processes more effective. It can be an effective method to integrate the security implementations provided by global supply chains offering cloud computing services with Privileged Access Management solutions. Ensuring supply chain security, especially for organizations with large distribution networks, is of great importance to keep the workflow sustainable and costs reasonable while increasing the sales rate.

What happened?

1. During Russia’s invasion of Ukraine, massive cyberattacks broke out – In one attack Russian websites were attacked using a malicious Widget
2. Numerous NPM packages were galvanized to harvest supply chain attacks
3. Cobalt-strike were planted in PyPi repositories to harvest supply chain attacks
4. Oktapus Phishing Campaign led to one of the supply chain attacks
5. Threat actors are seen exploiting  vulnerabilities in HP EliteBook firmware
6. Outdated versions of the OpenSSL cryptographic library in major laptop vendors led to a possible supply chain attack

Prediction # 4

Ransomware-as-a-Service Actors Pivoting to SMBs, Worrying factor

What said?

Ransomware-as-a-service (RaaS) has helped make digital extortion a booming business, and 2022 is likely to be another banner year for ransomware threat actors. Government involvement in the defense of critical infrastructure will motivate ransomware groups to target small and medium-sized businesses (SMBs) to draw less attention than larger, high-profile targets. One clear emerging trend is the rise in cybersecurity inequity between Fortune 500 companies and SMBs. Small businesses and mid-market enterprises have proven to be just as lucrative for things like ransomware attacks.

With government and big companies pouring cash into cybersecurity, underfunded and understaffed SMBs are prime targets for ransomware groups. The continuing development of ransomware-as-a-service (RaaS) will likely help lower the barrier to entry for cybercriminals and make it easier to launch ransomware attacks against major companies.

What happened?

Most Prolific Ransomware attacks in 2022  coverage from our  own TheCyberThrone serves as the answer

Prediction # 5

Deepfaking Cryptocurrency

What said?

Deepfake can be among the popular cybersecurity trends of 2022. The digitization and circulation of money as crypto money makes it more attractive to hackers. And deepfake technology allows users to relocate their images, making it easier for cybercriminals to access sensitive data. It is very possible to see more cyber-attacks on this topic in 2022.

What happened?

• Ronan Crypto Breach
• Cash App Crypto Breach
• Qubit Finance Crypto Breach
• Paybito Lockbit’ed
• Beanstalk Breach
• Discord NFT Breach
• Yuga labs NFT breach
• KyberSwap Breach
• Binance BNB Chain Hack
• Gemini Data Breach
• BTC Cyberattack
• BitKeep Breach

Prediction # 6

Mobile Devices Will Attack

What said?

Many end-users connect to e-commerce software and other online platforms through their mobile devices. Cybercriminals, in response, are targeting these users by putting greater effort into attacking mobile devices. In 2019, 93% of all attempted mobile transactions were fraudulent. This incidence of fraud, driven primarily by malicious apps, will continue to challenge businesses and cybersecurity experts in 2022.

What happened?

1. Surprisingly Telcos giants hit by a cyberattack – Optus, Singtel, TPG, Telstra, Altice and the list continues
2. Malicious mobile apps were found in the Google play store that preyed on Mobile devices  – Sharkbot, BRATA, Xenomorph, Vultur, roaming mantis, Hermit, SOVA and the list continues

Prediction # 7

5G An Opportunity with Vulnerabilities

What Said?

The faster speeds and improved connectivity offered by the technology may encourage increased adoption of IoT devices and other solutions that will rely on cell networks, rather than Wi-Fi or wired connections. This shift will likely have cybersecurity implications. IoT devices are often challenging to secure, despite strides in IoT security made over the past few years. Expanding a business’s security perimeter with new devices, like smart monitors and sensors, also typically results in new cybersecurity difficulties. For businesses that leverage 5G in 2022, new cybersecurity strategies may be necessary to keep their networks safe.

What happened?

Still, 5G is in the rollout phase in most countries, and the attack surfaces are yet to be exploited more.

• Open5GS vulnerability surfaced
• IoT attacks

Prediction # 8

Phishing and Social Engineering – Old School Syllabus that hard to clear

What Said?

Attacks that rely on social engineering’s, like phishing attacks, will continue to create difficulties for businesses in 2022. Employees that don’t know how to spot a phish may inadvertently leave their business’s networks open to hackers. Business-wide security training and investment in anti-phishing systems will help businesses educate their employees on security best practices and limit the effectiveness of these attacks.

What happened?

1. Ransomware families adopted different phishing techniques (Call back Phishing- Luna Moth Ransomware)
2. QakBot tied with many Ransomware families for initial intrusion
3. Email Security defenses bypassed by an Instagram Phishing campaign
4. American Express customers targeted with a Phishing campaign
5. PayPal accounts hijacked by a phishing campaign
6. Code repositories unfazed many phishing campaigns

Likewise, many attacks have occurred using Phishing campaigns

This brings end of this 2022 Prediction outcome review coverage. Thanks for visiting TheCyberThrone. If you like us please follow us on Facebook, Twitter