All sectors perceive increased mobile and IoT risk

Mobile phishing

Aaron Cockerill, Executive Vice President of Product & Security, Lookout

Data is the currency of modern enterprises. Establishing a strong data security strategy is not only a critical defense measure, but also a strategic business enabler.

In years past, organizations had dedicated private data centers, housing multiple servers, network equipment and storage devices. These setups not only presented scalability issues, but required continuous hardware and software upgrades to accommodate rising data needs. If not well maintained, this infrastructure is also highly susceptible to malware and vulnerability-based attacks.

Today, a majority of corporate data resides in the cloud across an increasing number of software-as-a-service (SaaS) and private apps. While this infrastructure is better maintained, making network bugs less of a concern, critical corporate data is also more widely distributed. This distribution presents other challenges, such as the risk of system misconfigurations, as sensitive data flows across an expanding set of apps.

With more corporate data residing in the cloud, we’re seeing a shift away from traditional malware and vulnerability attacks. Because cloud infrastructure is better maintained, the return on investment for traditional exploits has diminished. In response, threat actors have changed their Tactics, Techniques and Procedures (TTPs), to focus on leveraging social engineering, targeting a user’s mobile phone to steal credentials and impersonate users. With credentials in hand, they have immediate access to critical corporate infrastructure and sensitive data. We refer to this change in TTP strategy as the modern kill chain.

To illustrate, consider recent high-profile attacks: MGM Resorts, Caesars Entertainment and Twilio. In each instance, the threat actor group known as Scattered Spider used the phishing kit Oktapus to social engineer via mobile devices. In another example, the Lookout Threat Intel team discovered a similar phishing kit, CyptoChameleon that has been used by what was likely a different group of threat actors to target the FCC, Coinbase, Google, Microsoft and other organizations.

If a phishing attack is successful and a threat actor is able to get login credentials, the subsequent steps in the modern kill chain move rapidly. With direct access to an organization’s cloud infrastructure, the attack dwell time has gone from months to minutes. This also brings severe repercussions for individuals, who are at risk of identity theft, along with the organizations that are required to safeguard sensitive data. Defending against rapid modern attacks requires organizations to have clear visibility and automated response capabilities, both at the mobile endpoint and across their SaaS and private applications.