- •
Blockchain-based botnets are nearly impossible to dismantle - the Glukhtsaba botnet uses decentralized blockchain records for command and control, creating an immutable and decentralized infrastructure that traditional authorities cannot take down.
“They're using blockchain, which is an immutable record, which is accessible from all over the place because it's decentralized, in order to pass the command and control commands. It's kind of brilliant because you can't take the blockchain down.”
- •
Ransomware groups are funding original zero-day research - criminal organizations are moving upstream by offering researchers high-payout 'first-look' agreements for unpatched vulnerabilities, outbidding traditional bug bounty programs.
“Trend Micro published a report... It predicts that ransomware organizations will increasingly shift strategy to develop their own vulnerability research rather than using pen test teams or purchasing access credentials.”
- •
Threat actors are pivoting to cloud-native ransomware families - as data migrates, attackers are optimizing operations to target and encrypt unique cloud services rather than relying on traditional endpoint-focused malware.
“The report also believes that ransomware groups will better optimize operations to focus on targeting cloud infrastructure. This could include development of cloud specific ransomware families designed for unique cloud services.”