Cybercriminals attack enterprises through user identities, says IBM

Cybercriminals are increasingly targeting user identities to launch attacks on enterprises, a new report from a global tech company, IBM, has disclosed.

According to the report titled “2024 X-Force Threat Intelligence Index” released on Monday, the global trend is also reflected in the Middle East and Africa region, with the use of valid local accounts and valid cloud accounts.

It indicated that this was the primary cause of cyberattacks against organisations in the region, highlighting the need for strong user access and control strategies by enterprises.

The report stated that cybercriminals saw more opportunities to “log in” versus hack into corporate networks through valid accounts, making this tactic a preferred weapon of choice for threat actors.

 It revealed that Saudi Arabia was the most targeted country in MEA, representing 40 per cent of overall incidents that X-Force responded to in the region, followed by the United Arab Emirates, which made up 30 per cent of incidents.

 At the industry level, the most targeted sectors in the region were finance and insurance, making up 38 per cent of incidents, followed by transportation and energy at 19 per cent each.

 “Exploiting valid accounts has become the path of least resistance for cybercriminals, with billions of compromised credentials accessible on the Dark Web today.

 “The use of valid local accounts (52 per cent) and valid cloud accounts (48 per cent) represented  the most commonly observed initial infection vectors in cyberattacks against  organisations in the Middle East and Africa region, with espionage making up the top impact.”

According to IBM, the X-Force Threat Intelligence Index is based on insights and observations from monitoring over 150 billion security events per day in more than 130 countries.

In addition, data is gathered and analysed from multiple sources within IBM, including IBM X-Force Threat Intelligence, incident response, X-Force Red, IBM managed security services, and data provided from Red Hat Insights and Intezer, which contributed to the 2024 report.

 Globally, in 2023, X-Force saw attackers increasingly invest in operations to obtain users’ identities, with a 266 per cent uptick in infostealing malware.

The report expounded that they were designed to steal personally identifiable information like emails, social media and messaging app credentials, banking details, crypto wallet data and more.

It noted that in MEA, malware in general was the top action objective that X-Force observed threat actors using, representing 50 per cent of incidents.

It added that the use of malware was followed by DDoS, email threat hacking, server access and the use of legitimate tools for malicious purposes, all at 17 per cent, respectively.