Black Arrow Cyber Threat Intelligence Briefing 7 February 2025

9 Feb

Welcome to this week’s Black Arrow Cyber Threat Intelligence Briefing – a weekly digest, collated and curated by our cyber experts to provide senior and middle management with an easy to digest round up of the most notable threats, vulnerabilities, and cyber related news from the last week.

Executive Summary

Black Arrow Cyber's review of threat intelligence identified further evidence of an alarming increase in cyber threats targeting financial institutions, insurers, and enterprises, and the consequences that can include financial ruin.

Destructive cyber attacks have risen by over 12%, often erasing evidence rather than merely disrupting operations. Ransomware attacks surged by 26% in 2024, while phishing attacks have grown by nearly 50% since 2021, with AI-driven threats becoming more sophisticated. Insider threats are also on the rise, with ransomware gangs recruiting employees to facilitate breaches. Business leaders need to be aware that over 60% of enterprise cyber incidents stem from previously identified but unresolved risks, highlighting the need for proactive risk management. These trends underscore the evolving threat landscape and the critical need for a cohesive security strategy that includes continuous monitoring, the timely remediation of vulnerabilities, and employee awareness programmes.

The financial sector faces dual challenges from AI and cyber crime, with insurers ranking cyber attacks as an immediate risk. The weaponisation of AI in cyber attacks is accelerating, enabling adaptive, multi-stage social engineering campaigns. Meanwhile, credential-stealing malware now accounts for 25% of all malware activity, making identity protection a top priority. Cyber security governance is evolving to address this, with CISOs increasingly influencing business strategy and board directors taking a more proactive role in oversight.

As cyber risks intensify, Black Arrow Cyber advises businesses to prioritise cyber resilience, integrate security into corporate strategy, and enhance threat detection to safeguard operations, reputation, and financial stability.

Top Cyber Stories of the Last Week

Destructive Attacks on Financial Institutions Surge

Over half (54%) of financial institutions faced destructive cyber attacks last year, marking a 12.5% rise from 2023, according to Contrast Security. These attacks often serve to erase evidence rather than purely disrupt services. Two-thirds (64%) of firms reported cyber incidents, with cloud environments and APIs identified as key attack vectors. Despite strong detection rates (94%), attackers still bypassed defences, with 46 major breaches per month evading web application firewalls. Customer account takeovers rose by 48%, while 43% suffered ‘island hopping’ attacks where attackers exploit trusted relationships between organisations. The report highlights the need for continuous monitoring and application defence to counter evolving threats.

AI, Cyber Crime Perceived as Top Insurance Risks

The latest report from law firm Kennedys identifies artificial intelligence (AI) adoption and cyber crime as major risks for insurers. While AI is seen as the highest long-term risk, cited by over 85% of respondents, its full impact is expected to emerge over the next three to five years. Meanwhile, cyber attacks present a more immediate threat, with 27% of European, Middle Eastern, and African partners ranking it as their top concern for 2025. AI is also being exploited in cyber crime, increasing insurers’ exposure to data breaches. The report warns that inadequate cyber security could lead to severe financial, legal, and reputational consequences.

Ransomware Victims Increased by 26% in 2024

Ransomware attacks surged by 26% in 2024, with nearly 5,300 reported victims, according to a new analysis. The number of active ransomware gangs also grew, with LockBit remaining the most prolific despite a 50% drop in its victims. RansomHub rapidly scaled operations to take second place, while the Play gang continued to focus on manufacturing, real estate, and technology. Seasonal trends showed peak activity in spring and autumn, with summer seeing a decline. The US remained the most targeted country, with over 1,700 victims, more than ten times the number seen in Canada or the UK.

Over 60% of Enterprise Cyber Security Incidents Relate to Known Risks

A new report from ZEST Security reveals that 62% of enterprise cyber security incidents stem from previously identified risks that remain unresolved. Security teams struggle with long remediation times, taking 10 times longer to fix vulnerabilities than attackers take to exploit them. The financial burden is significant, exceeding $2 million annually. Backlogs are a key issue, with 87% of organisations managing over 100 critical security tickets. While automation and effort-based prioritisation are gaining traction, stricter SLAs and regulatory pressure are expected to drive faster remediation to mitigate the growing risk of cloud security incidents.

CISOs Drive the Intersection between Cyber Maturity and Business Continuity

The role of the CISO is evolving beyond IT, with one in five now reporting directly to the CEO, according to Deloitte’s latest cyber survey. High-cyber-maturity organisations are embedding cyber security into business strategy, enhancing resilience and enabling business continuity. Budget allocations are shifting, with cyber spending increasingly integrated into digital transformation and IT investments, reflecting its cross-functional impact. As regulatory pressures grow, particularly with new SEC disclosure requirements in the US, CISOs are playing a key role in risk management and compliance. Organisations with mature cyber strategies recover faster from incidents, protecting revenue, reputation and operations in an increasingly interconnected digital landscape.

Cyber Criminals Entice Traitorous Insiders via Ransom Notes

Ransomware gangs are now targeting employees with financial incentives to betray their and other organisations, embedding recruitment messages within ransom notes. Threat groups, including Sarcoma and DoNex, have begun soliciting insider access, offering substantial rewards for login credentials, network access, and sensitive data of any organisation. Security researchers note this tactic is a recent development, with threat actors exploiting disgruntled staff to bypass defences. While such offers may seem lucrative, experts warn that cyber criminals operate with no accountability, making payment unlikely. The shift highlights the evolving sophistication of ransomware operations, reinforcing the need for robust insider threat detection and employee awareness programmes.

Phishing Up Almost 50% Since 2021 with AI Attacks on the Rise

Phishing attacks have surged by 49% since 2021, with AI-driven threats emerging as a growing concern, according to Hoxhunt’s latest report. AI-generated phishing emails, while currently under 5% of reported cases, have risen sharply in just six months. On average, organisations with 1,000 employees face 2,330 phishing attempts that bypass filters each year, leading to 466 malicious clicks. Attackers frequently impersonate Microsoft, Docusign, and HR departments to exploit urgency and curiosity. Encouragingly, phishing awareness training can reduce incidents by 86% in six months, significantly enhancing organisational resilience against social engineering threats.

The Cyber-Driven Domino Effect: How Financial and Security Crises Bankrupt Businesses

A recent case involving Stoli Group highlights how cyber incidents can push financially vulnerable businesses into bankruptcy. Following a severe ransomware attack that disrupted financial reporting, Stoli was unable to provide lenders with key data, contributing to an $84 million debt burden and its eventual collapse. This case underscores the growing risk, which is especially high for small and medium-sized businesses (SMBs) that often lack the resources to recover from cyber attacks. With nearly 60% of SMBs failing within six months of an attack, organisations must prioritise cyber security resilience to prevent financial and operational ruin.

Board Directors Are Taking the Lead on Cyber Security Oversight

Board directors are increasingly taking a proactive role in cyber security oversight, shifting responsibility from IT teams to a company-wide approach. BDO’s 2024 board survey found that 37% of directors are broadening accountability, while many are investing in incident response strategies and regulatory compliance. The US SEC’s enhanced disclosure rules are driving the need for clear cyber incident reporting. Boards are also prioritising expertise, with 27% seeking cyber security knowledge in 2025. Directors are dedicating 42 hours annually to education, while external assessments, benchmarking, and evolving response plans are strengthening resilience against emerging threats.

Credential-Stealing Malware Surges in 2024

Credential-stealing malware now represents 25% of all malware activity, marking a threefold surge in this type of threat. Picus Security’s annual cyber security report found that credential theft has, for the first time, entered the top 10 techniques in the MITRE ATT&CK framework. Analysis of over one million malware samples revealed that just 10 attack techniques accounted for 93% of all malicious actions. Attackers are increasingly using stealthy multi-stage operations to extract credentials and leveraging encrypted channels to evade detection. Security teams can mitigate risk by focusing on the most prevalent attack techniques and enforcing strong authentication practices.

How Agentic AI will be Weaponised for Social Engineering Attacks

AI-driven social engineering attacks are evolving rapidly, with cyber criminals leveraging agentic AI to create highly personalised, adaptive, and multi-stage phishing campaigns. These AI agents can autonomously gather data, refine attack strategies, and deploy deepfake audio and video to deceive employees. Unlike traditional phishing, these threats are dynamic, adjusting to real-time responses. As AI becomes more autonomous, organisations must enhance defences by deploying AI-powered security tools, investing in adaptive awareness training, and fostering a cyber-aware culture. With AI-driven attacks set to rise, proactive measures are essential to mitigate risks and safeguard against increasingly sophisticated social engineering threats.

LinkedIn Has Become a Prime Hunting Ground for Cyber Criminals

LinkedIn has become a key target for cyber criminals using fake job offers to conduct social engineering attacks. A recent Bitdefender report highlights tactics used by the Lazarus Group, a North Korean state-sponsored threat actor, to deploy malware via fraudulent recruitment messages. Attackers trick victims into running malicious code disguised as job evaluation documents, ultimately stealing cryptocurrency wallet data and establishing persistence on systems. The group has also targeted sensitive industries such as aviation and defence. Experts warn professionals to remain vigilant, verify job offers, and avoid running unverified code outside secure environments like virtual machines.

Black Arrow Cyber Threat Intelligence Briefing 7 February 2025

Executive Summary

Top Cyber Stories of the Last Week

Destructive Attacks on Financial Institutions Surge

AI, Cyber Crime Perceived as Top Insurance Risks

Ransomware Victims Increased by 26% in 2024

Over 60% of Enterprise Cyber Security Incidents Relate to Known Risks

CISOs Drive the Intersection between Cyber Maturity and Business Continuity

Cyber Criminals Entice Traitorous Insiders via Ransom Notes

Phishing Up Almost 50% Since 2021 with AI Attacks on the Rise

The Cyber-Driven Domino Effect: How Financial and Security Crises Bankrupt Businesses

Board Directors Are Taking the Lead on Cyber Security Oversight

Credential-Stealing Malware Surges in 2024

How Agentic AI will be Weaponised for Social Engineering Attacks

LinkedIn Has Become a Prime Hunting Ground for Cyber Criminals

Sources:

Governance, Risk and Compliance

Threats

Ransomware, Extortion and Destructive Attacks

Ransomware Victims

Phishing & Email Based Attacks

Business Email Compromise (BEC)/Email Account Compromise (EAC)

Other Social Engineering

Artificial Intelligence

2FA/MFA

Malware

Bots/Botnets

Mobile

Denial of Service/DoS/DDoS

Internet of Things – IoT

Data Breaches/Leaks

Organised Crime & Criminal Actors

Cryptocurrency/Cryptomining/Cryptojacking/NFTs/Blockchain

Insider Risk and Insider Threats

Insurance

Supply Chain and Third Parties

Cloud/SaaS

Outages

Encryption

Linux and Open Source

Passwords, Credential Stuffing & Brute Force Attacks

Social Media

Malvertising

Regulations, Fines and Legislation

Models, Frameworks and Standards

Careers, Working in Cyber and Information Security

Law Enforcement Action and Take Downs

Misinformation, Disinformation and Propaganda

Nation State Actors, Advanced Persistent Threats (APTs), Cyber Warfare, Cyber Espionage and Geopolitical Threats/Activity

Cyber Warfare and Cyber Espionage

Nation State Actors

China

Russia

North Korea

Other Nation State Actors, Hacktivism, Extremism, Terrorism and Other Geopolitical Threat Intelligence

Tools and Controls

Other News

Vulnerability Management

Vulnerabilities

Sector Specific

Black Arrow Cyber Advisory 12 February 2025 – Comprehensive Security Updates from Microsoft, Adobe, Apple, and More

Black Arrow Cyber Threat Intelligence Briefing 31 January 2025