Connect with us

Tech & Innovation

Brace for more phishing, scams, data breaches, APT attacks in APAC 2024 – Kaspersky

Global cybersecurity company reveals that, in particular, the dangers of phishing, scams, data breaches, and geo politically-motivated cyberattacks are seen to continue targeting organizations and individuals from the region.

Published

on

Driven by the Asia Pacific’s (APAC) rapid digitalization movement and known geopolitical frictions, experts at Kaspersky predict the upcoming cybersecurity threat landscape in the region this year.

Global cybersecurity company reveals that, in particular, the dangers of phishing, scams, data breaches, and geo politically-motivated cyberattacks are seen to continue targeting organizations and individuals from the region.

“Asia Pacific’s digital economy continues to grow exponentially and is expected to keep its momentum in the next five years. With digitalization efforts including adoption of technologies like digital payments, Super Apps, IoT, smart cities, and now generative Artificial Intelligence (AI), cybersecurity will be key to ensuring the resilience of the region’s overall defenses against potentially damaging cyberattacks,” says Vitaly Kamluk, Head of Research Center for Asia Pacific, Global Research and Analysis Team (GReAT) at Kaspersky.

“When it comes to sophisticated Advanced Persistent Threats (APTs), we have seen that cyber espionage remains to be the main objective of Asian groups. We expect this trend to continue in 2024 due to the existing geopolitical tensions in the region,” Kamluk adds.

Kaspersky’s GReAT researchers have also specified the key cyberthreat predictions in 2024 for the key countries and territories in APAC.

South East Asia (Singapore, Philippines, Thailand, Vietnam, Malaysia, Indonesia)

The scale of scam in Southeast Asia

According to a report by the UN, hundreds of thousands of people from Southeast Asia (SEA) were recruited to join online-scam operations such as romance-investment scams, crypto fraud, money laundering and illegal gambling. Recruitment to these criminal operations are mostly done via advertised professional roles such as programmers, marketers or human resource specialists, through what appear to be legitimate and even elaborate procedures. 

Increased usage and trust in digital payment methods, lack of regulations protecting the rights of users online and large numbers of people forced into joining online-scam operations add complexity to this major issue in SEA and in resolving it.

“Law enforcement is working on many of those cases, involving scam and phishing attacks and we have seen successful operations in 2023, such as a joint operation of Australian Federal Police (AFP), and United States Federal Bureau of Investigation (FBI) and Malaysian Police which led to the arrest of 8 individuals behind a syndicate running a phishing-as-a-service campaign online,” says Kamluk.

“Nevertheless, we think that the scale of online scam and phishing attacks in Southeast Asia will only continue growing in the coming years due to technical and legal illiteracy of many people involved in such attacks from operators to victims,” he adds.

Singapore

Major technology safety and security highlights in Singapore in 2023 were related to data breaches and outages.

Financial service outages

In October 2023, DBS, one of the largest Singapore banks, experienced an operational failure due to datacenter outage, which resulted in 2.5 million failed transactions. Although, the reason for failure was not to be associated with a cyberattack at the time, given a prior history of outages, it will have implications on the bank’s strategies and priorities among which shall be increased reliability and safety of the services. As reported by the media, Citibank operations were also affected. While we embrace attention to improving the reliability and security of the infrastructure, it’s still the time of changes, which always opens a window of opportunities for the attackers.

DDoS attacks

Another highlight was related to web service outages of several public hospitals and polyclinics due to a distributed denial-of-service (DDoS) attack: the attackers flooded servers with internet traffic to prevent users from accessing online services. The disruption did not result in a compromise of data or internal networks according to publicly known information. This incident tells us that while the websites demonstrated resilience against potential compromises, they were unfortunately unprepared to a DDoS attack. 

Website defacements

A number of Singapore websites suffered from politically motivated defacement attacks in late 2023. Those attacks affected a historical temple website, a retirement info website, a tourism agency and other businesses located in Singapore.

“The bottom line is that the trend for future attacks in Singapore will likely be related to denial of service attacks, politically motivated compromises, defacements, and data leaks. Targeted ransomware threat is still real too, but will adopt the newest trend of pressuring the victim through regulator complaints,” explains Kamluk.

South Korea

Prominent political event and cybersecurity threats

In the upcoming year of 2024, South Korea is poised to hold a significant general election. Historically, major political events such as this have consistently attracted the attention of threat actors, who view them as prime opportunities for launching direct cyberattacks with the intent of disrupting the political proceedings. Furthermore, these threat actors often employ sophisticated social engineering techniques to achieve their goals. Thus, it is our firm belief that this impending major event will serve as a catalyst, intensifying the frequency and complexity of cyberattacks.

Customized Cyber Threats Targeting the Local IT Environment

Over the past several years, alleged state-sponsored threat actors have systematically infiltrated numerous entities within South Korea, employing widely adopted software solutions that are integral to the country’s IT infrastructure. These adversaries adeptly exploited vulnerabilities specific to the local, well-known software and IT ecosystem, thereby facilitating the successful dissemination of their malicious software to their unsuspecting targets. This nefarious activity wreaked havoc across various industries, causing extensive damage.

“As we look ahead to the year 2024, it is evident that these customized threats, meticulously tailored to exploit South Korea’s unique software landscape and IT environment, are poised to persist and pose an ongoing challenge,” adds Kamluk.

China

Telecom fraud activity will decrease, but phishing attacks may increase

In the past year, the Chinese government has been trying to find ways and even seek international cooperation to combat telecom fraud. In this high-pressure environment, the telecom fraud groups, known to be located in northern Myanmar, may soon collapse. 

However, Kaspersky researchers still have seen a wave of phishing attacks from unidentified groups over the past year launching frantic QR code phishing attacks on Chinese citizens, targeting personal credit card information. This group’s operations do not appear to be affected by the situation in northern Myanmar, and based on Kaspersky statistics and observed behavioral patterns, attacks may peak again at the end of the year and early next year. 

APT attacks on high profile targets will become increasingly active

Earlier this year, Chinese authorities reported cyberattacks on various national institutions and organizations. The CVERC reported isolating a spyware artifact named “Second Date”. This advanced cyber-espionage tool can fully control targeted network devices and enable prolonged data theft.

Targets that were compromised include a university developing military-industrial projects and government departments that maintain basic geographic data. In addition, Kaspersky have also noticed that some long-term active APT organizations have launched APT attacks against Chinese nuclear energy companies and unknown targets. 

Given China’s geopolitical prominence, Kaspersky experts expect that the number of APT attacks targeting the country will only increase in the future.

India

India has been traditionally suffering from a number of low skill but high scale scam and fraud cases. Typical threats include the following:

  • Illegal or fake digital loan apps
  • Income tax refund services
  • Real estate fraud
  • Investment scam
  • Ponzi schemes online
  • Job fraud
  • Sextortion

“The rise of technologies and digitalization of the Indian economy, such as increased use of the sophisticated Unified Payments Interface (UPI), the software from the National Payments Corporation of India, will lead to a wave of related scams. Another opportunity for scammers is the ever-rising popularity of cryptocurrencies, which may lead to a new generation of scam apps,” explains Kamluk.

Also, a growing popularity of micro-loan apps has resulted in new schemes to target users in India through unexpected inflated premiums and personal threats. 

In addition, with India’s move towards smart cities, IoT vulnerabilities pose serious security challenges for the country. 

For organizations in APAC, Kaspersky shares the tips below to keep safe from these upcoming threats in 2024:

  • Always keep software updated on all the devices you use to prevent attackers from infiltrating your network by exploiting vulnerabilities. 
  • Establish the practice of using strong passwords to access corporate services. Use multi-factor authentication for access to remote services.
  • Choose a proven endpoint security solution such as Kaspersky Endpoint Security for Business that is equipped with behavior-based detection and anomaly control capabilities for effective protection against known and unknown threats. 
  • Use a dedicated set for effective endpoint protection, threat detection and response products to timely detect and remediate even new and evasive threats. Kaspersky Optimum Security the essential set of endpoint protection empowered with EDR and MDR.
  • Use the latest Threat Intelligence information to stay aware of actual TTPs used by threat actors.

Tech & Innovation

Tips to protect yourself against holiday cyber threats

This period sees a surge in online activities and financial transactions — from scouring for the best shopping deals to holiday travel bookings, ticket purchases, and cross-border money transfers for holiday gifts— this holiday shopping season is a prime time for cybercriminals to take advantage of the unsuspecting digital shoppers through phishing scams, fraudulent websites, and payment fraud.

Published

on

As the highly anticipated year-end shopping season such as 12.12 Sales draws near, Palo Alto Networks urges heightened cybersecurity vigilance. This period sees a surge in online activities and financial transactions — from scouring for the best shopping deals to holiday travel bookings, ticket purchases, and cross-border money transfers for holiday gifts— this holiday shopping season is a prime time for cybercriminals to take advantage of the unsuspecting digital shoppers through phishing scams, fraudulent websites, and payment fraud.

The impact is evident in the losses reported in the Philippines in 2024, totaling $8.1B due to online scams. With online activity set to surge during the upcoming shopping season, this underscores the critical need for heightened cybersecurity awareness.

“As the Philippines’ retail and e-commerce sectors continue to expand, the need for strengthened cybersecurity becomes even more critical,” said Oscar Visaya, Country Manager for Palo Alto Networks in the Philippines. “The first line of protection is always proactive defense. Businesses must proactively secure their platforms and consumers should remain vigilant to ensure safety and security this holiday season.”

The rise of online shopping, digital payments and holiday planning has transformed consumer behavior in the Philippines but has also introduced new risks. High online transaction volumes during key events like 11.11, Black Friday, and holiday travel planning create opportunities for cybercriminals, especially as consumers increasingly leverage digital payment methods for their transactions. Locally, 53% of consumers use QR codes while 68% rely on mobile wallets, increasing exposure to cyber threats.

As online transactions surge, consumers face growing risks from threats like APK attacks — malicious software targeting mobile apps—and deepfake scams. To stay safe, consumers need to be on guard about their online security, especially during peak holiday seasons. 

Palo Alto Networks offers the following best practices to ensure a safe experience:

  • Verify Authenticity: Double-check emails and offers before clicking on any links. Look out for misspellings, unusual domains, and suspicious attachments.
  • Use Two-Factor Authentication (2FA): Enable 2FA for all accounts, especially when shopping online, to provide an extra layer of security.
  • Shop Through Official Channels: Avoid unofficial or unknown websites. Stick to trusted and secure online shopping platforms.
  • Beware of Phishing Scams: Be cautious of deals that seem too good to be true and fake order confirmation emails.
  • Strengthen Passwords: Use strong, unique passwords for all online accounts and consider using a password manager for added security.
  • Avoid Sharing Personal Information: Never provide sensitive personal details like social security numbers or banking information in response to unsolicited requests.

At the same time, businesses must strengthen their defenses against cyber threats. Common threats during peak periods include social engineering tactics like phishing scams, which trick employees into sharing sensitive information, and ransomware attacks, which can lock down critical systems until a ransom is paid. Additionally, Distributed Denial of Service (DDoS) attacks can overwhelm retail websites with traffic, causing potential downtime and disrupting the customer experience.

To effectively mitigate these risks, businesses should adopt a Zero Trust approach that emphasizes strict verification for every user and device accessing their networks, ensuring that no implicit trust is given. By integrating comprehensive threat detection, response, and data protection into a Zero Trust framework, businesses can enhance visibility, streamline security operations, and enable real-time threat responses. This approach not only safeguards sensitive data but also maintains a seamless user experience, ensuring both protection and convenience for consumers.

“Whether you’re a business owner, employee, or consumer, cybersecurity is a shared responsibility. With the holiday season and Christmas shopping in full swing, Filipinos may feel more inclined to act on attractive offers without verifying the source. Always verify and adopt a Zero Trust thinking. If the offer is too good to be true, it probably is.  By fostering a culture of vigilance, we can protect ourselves and others in a landscape where threats are constant” added Visaya.

Continue Reading

BizNews

TikTok users seek authenticity in sponsored content, dismissing top influencers in favor of smaller creators

Engagement around brand-sponsored content mirrors TikTok’s own image as an unfiltered, raw, and authentic platform.

Published

on

High-profile and popular influencers on TikTok should rethink their approach to brand-sponsored campaigns since followers better engage and trust the authenticity of smaller creators over super influencers when it comes to paid content.

The study published in Psychology & Marketing from the University of Ottawa’s Telfer School of Management aims to help brands and businesses develop more successful strategies on the social media platform by delving into how users interact with sponsored user-generated content. They found engagement around brand-sponsored content mirrors TikTok’s own image as an unfiltered, raw, and authentic platform.

Consumers questioned the authenticity of super influencers (over half a million followers), showing less engagement with their sponsored posts relative to their non-sponsored content in contrast to smaller creators (15K followers) who did not experience a drop when promoting similar sponsored content. The niche engagement felt by smaller influencers in promoting sponsored content can be attributed to their size, which makes them able to foster a stronger sense of trust.

Although popular influencers may face challenges with sponsored content, when they promote smaller, lesser-known brands, engagement remains strong. However, endorsing large, well-known brands often results in lower consumer engagement due to perceived lack of authenticity.

“This likely stems from the perception that more popular creators prioritize commercial interests and monetary gains over genuine connections with their audience and the sheer size of their audience may dilute the personal connection with viewers,” says Argiro Kliamenakis, an Assistant Professor of Marketing at Telfer. “This issue is exacerbated when large influencers promote large brands, as these brands are often perceived as inauthentic and profit-driven, leading to lower engagement with this type of content. Therefore, larger brands may find greater value in sponsoring multiple smaller creators and employing other promotional strategies with larger influencers to encourage organic content.”

With authenticity instrumental to reaching audiences, brand managers should exercise discretion when choosing brand partnerships and look to leverage the authenticity of micro-influencers or niche content creators with engaged followings which can lead to favorable responses to sponsored content. Smaller brands can also engage with more popular creators to take advantage of their influence and visibility without sacrificing consumer engagement.

“This research provides valuable insights into how brands can effectively engage audiences on TikTok, shedding light on the nuances of consumer behavior on this platform, which can help brands and businesses develop more successful strategies,” said Kliamenakis, who points to the emerging popularity of TikTok Lives offering another aspect that needs to be looked at. “It would be valuable to investigate how consumers respond to these emerging content formats and how they might influence engagement and perceived authenticity.”

Continue Reading

BizNews

When is the right time to launch new technologies?

Being on the cutting edge of technology is not enough to ensure success in the market, and managers must strategically time launches to create a source of opportunity and credibility for the firm.

Published

on

Research from Bayes Business School (formerly Cass) finds that being on the cutting edge of technology is not enough to ensure success in the market, and managers must strategically time launches to create a source of opportunity and credibility for the firm.

The study, led by Dr Thomas Robinson, Senior Lecturer in Marketing at Bayes, with Dr Ela Veresiu, Associate Professor of Marketing at Schulich School of Business, York University, Toronto, develops a framework for guiding organisations on the best situations for a product launch.

The research identifies four timing situations that can confront marketing managers. Knowing the features and traits of each timing category allows firms to develop a launch strategy leading to success:

  • Synergistic timing is the optimal, legitimate launch condition whereby a firm and its stakeholders share norms about when things should occur. Here the market is ready for a product and stakeholders are ready to embrace change.
  • Flexible timing consists of low firm-led coordination but high stakeholder willingness to change. Consumers and other stakeholders initiate the legitimacy of a launch moment by being open to a product’s prospective utility. Flexible timing can become synergistic timing if a firm decides its product is sufficient for early release, or it can buy time with consumers by sharing prototype failures or ‘drip-feeding’ information about a product.
  • Inflexible timing occurs when there is little appetite from stakeholders to change their timing expectations, so the firm must induce appetite for new technology that can overcome stakeholder caution about the future. To move from inflexible to synergistic timing, managers should aim to restrict a product’s tech functionality or increase its dependency on human intervention.
  • Antagonistic timing arises when both stakeholder willingness to change and firm-led coordination are low, and launching new technology should not be a priority in this instance.

The conceptual paper draws on the 2013 release of the Google Glass augmented reality (AR) experience, which failed because it launched at the wrong moment. The firm itself was not adequately prepared, nor were consumers ready to accept the functionality of the device, leading to the glasshole moniker. A decade later, consumers are ready for public filming and social media sharing. Legislation is also in place in a way that now makes Ray-Ban’s Meta Smart Glasses a very desirable device.

Launching new technology in the market is therefore, according to the research, a social game, in which timing is an issue of poise and tact when engaging with stakeholders. Offering time signals consideration, respect, and mindfulness. Not offering enough time is rude and gets in the way of understanding and feeling comfortable around the new technology.

The research was supported by a comprehensive review of literature looking into the role of time in market legitimacy, using the Business Source Complete database to extract academic articles around subject – plus articles from 20 4*,4 and 3 ranked marketing journals that contained key words. The resulting sample of 172 articles were then coded to identify key and recurring themes around time.

Dr Robinson said insights on the role of timing are essential for firms to improve the odds of success at launch.

“While 30,000 new products are introduced every year, 95 percent fail,” he said.

 “Consider a marriage proposal on the first date, a request for more time after ten years in a relationship, waiting too long to thank a relative for a birthday present or serving a dessert before the mains at a dinner party. Stakeholders have strong timing-norms about pacing, sequencing, coordination and planning that impact the readiness of the market.

“While marketers often have a linear view of technology, our research on timing reveals that it is not always the case that the old is simply replaced by the new – often old, failed technologies have a comeback.

“Product categories like AR glasses rose from their own ashes in ‘phoenix markets’, suggesting that it can be worthwhile to revisit old failures. Smartwatches, electric cars, and social media were all initial failures that later succeeded. Substantial losses could have been avoided had they had better timing frameworks.

“While the timing framework is developed for launching new technologies, our research also has broader applications for rebranding and mergers, political marketing, understanding the fashion cycle, service design and the experience economy.”

Timing Legitimacy: Identifying the Optimal Moment to Launch Technology in the Market’ by Dr Thomas Robinson and Professor Ela Veresiu is published in the Journal of Marketing.

Continue Reading
Advertisement
Advertisement

Like us on Facebook

Trending