Q3 2024 cyber threats: the Cato CTRL report

Ransomware, Shadow AI and vulnerabilities: a fast-evolving threat

Cato CTRL Q3 2024 Cybersecurity Report

Cato CTRL, the cyber threat research lab of Cato Networks, provides in its Q3 2024 report an in-depth view of how cyber threats are evolving.

Based on the analysis of nearly 1.5 trillion network flows from more than 2,500 customers, the report highlights worrying trends and recurring challenges.

Compared with the second quarter, some threats are taking on a new dimension, while others continue to grow with increasingly serious implications.

Ransomware: an ever more structured threat

The report reveals growing sophistication in ransomware. Now organised as Ransomware-as-a-Service (RaaS), this criminal business model employs penetration testers to make attacks more effective.

A striking example is Hunters International, a criminal group that used tools such as PsExec and AnyDesk to encrypt and exfiltrate critical data.

In the second quarter, attacks focused more on exploiting vulnerabilities such as Log4j.

This shift underlines cybercriminals' ability to innovate quickly and professionalise their operations, making information systems even more vulnerable.

Shadow AI: uncontrolled growth

Unapproved artificial intelligence tools continue to proliferate in companies. This phenomenon, known as Shadow AI, represents an increased risk of sensitive data leaks and compliance breaches.

While in the second quarter informal use of generative AI was largely limited to Microsoft Copilot and ChatGPT, the usage now observed shows this risk is worsening, particularly in highly sensitive sectors such as finance and healthcare.

This is a reminder of how important it is for organisations to draw up clear internal policies governing the use of these tools.

TLS inspection: a persistent blind spot

The report reveals that only 45% of organisations inspect encrypted TLS traffic. Although slightly up on the previous quarter, this level of adoption remains far too low, since attacks hidden in encrypted traffic account for 52% of the threats blocked by proper inspection.

The report stresses the urgency of adopting technologies such as Safe TLS Inspection, which can automate this complex task.

Exploited vulnerabilities: Log4j still on top

Three years after its discovery, the Log4j vulnerability continues to dominate attacks. In the third quarter, it remained a priority target, with attempts exploiting WAN-bound and TLS traffic. These observations extend a trend already identified in the second quarter, when Log4j attacks had risen by 61% compared with the start of the year.

Besides Log4j, vulnerabilities such as Oracle WebLogic and flaws in Microsoft Exchange were actively exploited.

These developments reflect cybercriminals' intensifying efforts to exploit any weakness in systems.

Brand impersonation: Amazon still targeted

Cybersquatting remains a major attack vector, with Amazon far ahead among impersonated brands. While the previous quarter saw techniques such as typosquatting, this quarter's activity highlights the rise of levelsquatting, where deceptive subdomains are used to trap users.

This continuity shows how important it is for companies to monitor abuse of their brands and raise awareness among customers and partners of the risks of fake web pages.

Progress and stagnation in secure protocols

Despite a slight improvement in the adoption of protocols such as HTTPS and SSH, the report points out that 64% of WAN traffic is still based on HTTP, an outdated protocol. This figure is comparable to the previous quarter, when sectors such as agriculture and metals showed excessive use of Telnet and other insecure protocols.

The report once again calls for a rapid transition to modern protocols such as SMBv3 and HTTPS to secure communications.

Conclusion: vigilance is essential in the face of evolving threats

This Cato CTRL report highlights the growing professionalisation of cybercriminals, with diversifying methods and targets.

The need to act has never been greater, by strengthening defences with advanced tools and proactive governance.

Key recommendations:

• Strengthen TLS inspection: automate the identification and handling of threats in encrypted traffic.
• Adopt secure protocols: accelerate the transition to HTTPS, SSH and SMBv3.
• Govern AI use: draw up policies to limit the risks of Shadow AI.
• Raise awareness: train employees on risks such as ransomware and brand impersonation.

📘 Find the full report 👇

Cato CTRL – Cyber Threats Research Lab →

How are these reports produced? Cato CTRL is the cyber threat intelligence unit of Cato Networks. It uses data from the Cato SASE Cloud platform to analyse and identify internal and external threats. The Q3 2024 report is based on the examination of 1.5 trillion network flows collected from more than 2,500 customers worldwide. This analysis is deepened through artificial intelligence algorithms and the expertise of Cato Networks analysts, providing a detailed and relevant picture of today's threat landscape.