Throughout its history, the automotive sector has proven to be a very important and constantly growing industry, mobilizing ever-increasing amounts of money. This economic component, coupled with the application of technological innovation (connected vehicles, autonomous vehicles, among others), places both companies and entities in the sector in the crosshairs of malicious actors and cybercriminals.
S21sec conducted a detailed analysis of the automotive industry's cyber activity throughout 2022, identifying a considerable increase in incidents of varying natures. Most of the detected cyberattacks originated from the exploitation of vulnerabilities in organizational infrastructure, but ransomware attacks, access sales, database sales, and data breaches were also identified.
Regarding this topic, experts warn that criminal activity against companies in this sector will increase in the coming months. “ The automotive industry is constantly implementing the most advanced technologies, aiming to automate and streamline all industrial processes and also incorporate the latest features into its products. However, automation also brings new risks in the field of cybersecurity, which these companies must consider in both IT and OT ,” says Hugo Nunes, head of the Intelligence team at S21sec in Portugal.
Ransomware, an imminent threat.
Ransomware, a type of attack aimed at gaining access to one or more computers to encrypt the information of a target, whether a user or an organization, and demand a ransom in exchange for its return, has positioned itself as one of the main threats facing the automotive industry. Up to September of this year, 41 ransomware attacks were recorded against organizations in this sector, with March standing out for the high number of incidents.
The ransomware groups that most targeted this sector were Lockbit, with 10 attacks against automotive companies, and Conti, with potp. Regardless of the sector, these two groups were among the most active during 2022, although it is possible that the trend will change in the coming months, since the Conti group ceased its activity after the publication of its source code.
This type of attack has evolved into double and triple extortion techniques. In a double extortion attack, cybercriminals, in addition to encrypting the data, threaten the victim with publishing or selling the encrypted information. In the case of triple extortion, in addition to threatening the victim with publishing the stolen data, the attacker pressures them with DDoS attacks on the victim's technological infrastructure.
Selling sensitive information on the Deep Web
S21sec also identified an increase in the sale of initial access credentials on Deep Web forums by so-called IABs (Initial Access Brokers). These are responsible for obtaining different types of access to organizations (such as equipment access credentials, VPN or RDP access) through the use of different tactics and techniques, which they then sell on various "underground" forums or to affiliates of ransomware groups. During the analyzed period, 24 sales of initial access credentials to companies in the automotive sector were found on different forums such as Exploit, RAMP or XSS.
Furthermore, it was verified that several databases belonging to companies in the automotive industry were compromised. This private information constitutes one of the fundamental pillars upon which the business model of these types of organizations is maintained, since it is related to the products and services they offer and allows them to differentiate themselves from the competition by storing confidential information about future plans, clients, employees, suppliers, among others. During this year, S21sec has already identified eight sales of internal databases from different companies related to the automotive world on forums and in Deep Web marketplaces, such as the Exchange Market.
“ Data theft and subsequent acquisition of confidential information by third parties outside the company can cause a serious crisis and even lead to its bankruptcy. Most of these types of sales occur mainly when cybercriminals gain access to the company's infrastructure, either through social engineering attacks, exploitation of vulnerabilities, or through infiltrated agents—company personnel who provide information to attackers in exchange for a reward, usually financial, although they may also be victims of extortion ,” says Hugo Nunes.
