CYFIRMA INDUSTRY REPORT : LOGISTICS

EXECUTIVE SUMMARY:

The CYFIRMA Industry Report delivers original cybersecurity insights and telemetry-driven statistics of global industries, covering one sector each week for a quarter. This report focuses on the logistics industry, presenting key trends and statistics in an engaging infographic format.

INTRODUCTION:

Welcome to the CYFIRMA infographic industry report, where we delve into the external threat landscape of the logistics industry over the past three months. This report provides valuable insights and data-driven statistics, delivering a concise analysis of attack campaigns, phishing telemetry, and ransomware incidents targeting the logistics industry.

We aim to present an industry-specific overview in a convenient, engaging, and informative format. Leveraging our cutting-edge platform telemetry and the expertise of our analysts, we bring you actionable intelligence to stay ahead in the cybersecurity landscape.

METHODOLOGY

CYFIRMA provides cyber threat intelligence and external threat landscape management platforms, DeCYFIR and DeTCT, which utilize artificial intelligence and machine learning to ingest and process relevant data, complemented by manual CTI research.

For the purpose of these reports, we leverage the following data from our platform. These are data processed by AI and ML automation, based on both human research input and automated ingestions.

OBSERVED ATTACK CAMPAIGNS

• Leveraging our Early Warning platform data set, we present known attack campaigns conducted by known advanced persistent threat actors. Both nation-state and financially motivated.
• Each attack campaign may target multiple organizations across various countries.
• Campaign durations can vary from weeks to months or even years. They are sorted by the “last seen” date of activity to include the most relevant ones. Note that this may result in campaigns stacking up on later dates, affecting time-based trends.
• Attribution to specific threat actors can be murky due to increasingly overlapping TTPs and commodity tools used. While suspected threat actors in this report are attributed with high confidence, we acknowledge the potential for inaccuracy.

PHISHING

• Our data focuses on phishing campaigns rather than individual phishing or spear-phishing emails, which may limit visibility into more advanced single-target attacks.
• Our primary focus is on detecting brand impersonation over intended targets. Due to our collection methodology and automation, we may not present comprehensive victimology for phishing campaigns across all industries as some are simply not good phishing lures.

RANSOMWARE

• The victim data presented in this report is directly sourced from the blogs of respective ransomware groups. However, it’s worth noting that certain blogs may provide limited victim information, such as only names or domains, while others may be entirely obfuscated. These limitations can impact the accuracy of victimology during bulk data processing.
• In some cases, multiple companies share the same name but are located in different countries, which may lead to discrepancies in geography and industry. Similar discrepancies occur with multinational organizations where we are not able to identify which branch in which country was compromised. In such a case, we count the country of the company’s HQ.
• During the training of our processing algorithms, we manually verified results for industry and geography statistics at an accuracy rate of 85% with a deviation of ±5%. We continuously fine-tune and update the process.
• Data related to counts of victims per ransomware group and respective dates are 100% accurate at the time of ingestion, as per their publishing on the respective group’s blog sites.
• Finally, we acknowledge that many victims are never listed as they are able to make a deal with the attackers to avoid being published on their blogs.

VULNERABILITIES

• Statistics presented are processed from CYFIRMA DeCYFIR platform which collect reported vulnerabilities from plethora of available sources and vendors.
• Filtering is based on categorization of vendors. Specifically, vendors directly related to specific industry and supporting vendors, such as Microsoft or Oracle, used in most industry’s operations.
• We are only presenting vulnerabilities with CYFIRMA score 8 and higher to maintain clarity and concise presentation.

While this report contains statistics and graphs generated primarily by automation, it undergoes thorough review and enhancement for additional context by CYFIRMA CTI analysts to ensure the highest quality and provide valuable insights.

ADVANCED PERSISTENT THREAT ATTACK CAMPAIGNS

Logistics organizations featured in 5 out of the 11 observed campaigns, which is a presence in 45% of all campaigns.

OBSERVED CAMPAIGNS PER MONTH

After a period of lower detections in earlier months, we observed a spike in newly detected campaigns during November.

SUSPECTED THREAT ACTORS

Observed threat actors are split between China and Russia linked groups, as well as suspected Pakistan aligned Transparent Tribe group.

GEOGRAPHICAL DISTRIBUTION

Recorded victims of observed attack campaigns span 18 different countries. There does not appear to a be clear geographic pattern besides trading economy size. Observed campaigns seemingly focus on APAC-US-EU trading partnerships.

TOP ATTACKED TECHNOLOGY

Web applications continue to be the most targeted technology across industries.

APT CAMPAIGNS

Risk Level Indicator: Moderate

In the past 90 days, logistics organizations have been significantly impacted by advanced persistent threat (APT) campaigns. 45% of observed APT campaigns recorded logistics industry victims, with 5 out of 11 total campaigns.

Monthly Trends
Since lower detections in earlier months, observed campaigns spiked during November to 4.

Key Threat Actors
The logistics industry is vital to global economics and geopolitics, making it a frequent target for nation-state APT groups. Key actors include Russian-linked groups, such as Fancy Bear, Cozy Bear, and TA505, as well as China-based Stone Panda and APT41, also tracked as MISSION2025. Additionally, Pakistan’s Transparent Tribe (APT36) has been active in this industry.

Geographical Impact
The campaigns impacted a total of 18 countries. Countries with large economies and trade such as the US, the UK, Japan, and India are the most frequent victims.

Targeted Technologies
Web applications with Operating systems remain the most frequently targeted technologies.

PHISHING ATTACKS IN THE HEALTHCARE INDUSTRY

Over the past 3 months, CYFIRMA’s telemetry detected 4,267 phishing campaigns themed around the logistics industry out of a total of 200,586.

The chart below illustrates the global distribution of observed themes. Combined logistics & Couriers and Transportation accounts for 2.12% of all captured phishing attempts, placing logistics as 6th most frequent phishing theme.

GLOBAL DISTRIBUTION OF PHISHING THEMES

TOP IMPERSONATED BRANDS

In total, 42 logistics organizations were impersonated in captured phishing attempts during the last 90 days. The Top are USPS and DHL, together with many national or regional postal services.

TOP COUNTRIES OF ORIGIN (ASN)

The US is a leading source of logistics-themed phishing, aligned with the volume of USPS impersonations. In total, 60 countries were observed.

PHISHING

Comparing the logistics industry to all recorded victims, Inc Ransom stands out with a high percentage of victims in this industry, recording 4 out of 22 (18%) of their victims in the logistics industry, implying a focus on this industry.