In a year of upheavals that saw the death of Queen Elizabeth II, three changes of UK prime minister, and Russia’s invasion of Ukraine, one thing that has remained unfortunately consistent is cyber criminals ramping up attacks.
Some trends prevail: Ransomware remains popular, fuelled by the sheer volume of revenue available to the gangs and criminals involved in the lucrative market. The Lapsus$ group has been particularly active in 2022, allegedly breaching the likes of Microsoft, Uber, and Nvidia.
The supply chain is still a common vector of attack, with the Okta breach at the beginning of the year showing the damage that can be done to a firm’s reputation if it fails to act quickly in disclosing an incident.
Cyber criminals have also started to broaden their horizons to focus on digital currencies, with cryptocurrency exchanges, platforms, and personal wallets increasingly targeted over the course of the year.
We’ve rounded up the scariest security horror stories of 2022.
Log4Shell vulnerability wreaks havoc throughout 2022
The Log4Shell vulnerability continues to wreak havoc on businesses a year after it first sent shockwaves through the security industry. Discovered in December 2021, the zero-day remote code execution (RCE) flaw in Java logger Log4j was so impactful because of the sheer number of applications and services it powers: Log4j is used by millions of computers across many organisations and underpins multiple internet services and applications, including Twitter, Microsoft, and Amazon.
With a 10/10 critical rating, the Log4Shell flaw – which has the NIST National Vulnerability Database designation CVE-2021-44228 – is relatively easy to exploit, because it doesn’t require privileged access to be used in attacks. It’s therefore no surprise that just 24 hours after it was disclosed, researchers at security firm Checkpoint recorded almost 200,000 attempts to exploit the issue. A week after Log4Shell went public, cyber criminals and other malicious actors had used the flaw as part of over 1.2 million attacks globally.
The Log4Shell issue persisted well into 2022. In February, the flaw was used by Iranian state sponsored attackers targeting the US government….