New data in Flashpoint’s Cyber Threat Intelligence Index: 2024 Midyear Edition shows a significant rise in cyber-vulnerabilities, with 17,518 newly disclosed vulnerabilities in the first half of the year, up 11% from the first half of 2023. The number of publicly known exploits rose 6% over the same period.

The report, based on data, trends and emerging cyber-threats observed between January 1 to June 30, found that 45% of these vulnerabilities found so far were marked as high or critical exposures, according to the Common Vulnerability Score System v3 (CVSSv3).

Additionally, the data highlights an increase in the use of information-stealing malware, which Flashpoint describes as a simple, effective, easy to obtain, and inexpensive tool for threat actors to use.

As well as the 13 million devices found to be infected with info-stealer malware, the report found 4.8 million individual infected hosts who had a total of 53 million credentials stolen over the course of this year. In total, Flashpoint reports that it has collected over 456 million stolen or leaked credentials.

The most commonly used malware software found by the report was Redline Stealer, with 3,009,051 infected hosts around the world.

Cyber-criminals are increasingly using this info-stealing malware across the globe, using the stolen data to fuel increasingly complex and damaging ransomware attacks. The United States remains the primary target for ransomware groups, followed by the United Kingdom and Canada. 

This is driven by factors such as availability of high-profile targets, the potential for more lucrative ransom payments, and the challenges in dismantling sophisticated ransomware operations. 

Recommended reading

• LockBit Ransomware Group Leader Exposed
• Lockbit Tries to Relaunch Following Global Police Takedown
• LockBit 3.0 Dethroned and New Players are Emerging

According to the data, the LockBit ransomware group remains the most prolific attacker, responsible for 428 attacks through the half year, well ahead of Play with 175 recorded attacks. Notably, LockBit has made it to the top of the list after a coordinated operation by global law enforcement organisations, called Operation Cronos, disabled the gang’s key infrastructure in February 2023

The research also makes note of the rise in insider-threats, with Flashpoint observing more than 8,497 unique instances of insider recruiting, advertising, or general discussions involving insider-related threat activity across its chat collections.

The majority of these insider threat activity came from individuals advertising their services to malicious actors. Most of this activity occurred in the telecom industry, where employees solicited to perform SIM swaps for threat actors.

“The cyberthreat landscape is increasingly volatile and interconnected,” said Flashpoint chief executive Josh Lefkowitz. “Vulnerabilities and exploits are on the rise and threat actors are exploiting these weaknesses.”