The purpose of the Netskope Threat Labs News Roundup series is to provide enterprise security teams an actionable brief on the top cybersecurity news from around the world. The brief includes summaries and links to the top news items spanning cloud-enabled threats, malware, and ransomware.

Threat actors continue to exploit cloud services for cyber espionage, and a new campaign by a threat cluster named WIP26, discovered recently by researchers at Sentinel One in collaboration with QGroup, targeting telecommunication providers in the Middle East, confirms this trend.

Let’s face it, your remote connectivity architecture isn’t going to cut it for much longer. Maybe you struggle with providing uniform secure optimized access, or with a patchwork of multi-vendor policies, or with network blind spots across all remote users, devices, sites, and clouds. One or all of these issues can lead to a situation that would significantly impact digital business operations. Fortunately, there’s a better way.

Netskope has just published the Monthly Threat Report for February, with this month’s report focused on what is going on in Europe. I don’t intend to summarise the report in this blog, instead I want to zoom in and study a continuing trend that was highlighted in there; one that is unfortunately heading in the wrong direction.

The widespread adoption of cloud transformation and hybrid work are increasing the attack surface while attacks get increasingly sophisticated. Attacks targeting cloud infrastructure and email-borne threats have soared to unprecedented levels, making it critical for organizations to protect sensitive data regardless of where it may be stored.

February 24, 2023 marks one year since Russia invaded Ukraine, starting a conflict that has killed more than 8,000, injured more than 13,300, and displaced more than 14 million people in the past year, according to the UN. Physical warfare between Ukraine and Russia has been accompanied by cyberwarfare between the two countries. This blog post focuses on cyberwar, particularly what we can learn from the past year.

Starting with January 2023, Netskope Threat Labs will publish a monthly summary blog post of the top threats we are tracking on the Netskope Security Cloud platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide.

The underground economy of the initial access brokers (IABs) is more flourishing than ever. At least this is one of the conclusions of the recent report “Hi-Tech Crime Trends 2022/2023” released by Group-IB. Initial access brokers exploit vulnerabilities or misconfigurations to get hold of valid access credentials (typically VPN or RDP) and outsource or sell them to criminal gangs, including ransomware operators.

This year’s Okta Business at Work annual report highlights growth, despite national headlines with concerns about a recession and economic contraction. Given Okta’s role as a leading identity service provider, the growth theme is good news for stronger authentication and protection against access compromise, phishing, and ransomware.

I recently attended the LEAP tech event in Saudi Arabia, and it was clear walking the trade show floor that 5G is hitting critical mass. Lightning-fast network connections are now rolling into cities across Saudi Arabia and the wider world, and while it’s true that some countries are further into the rollout of 5G than others, all the network providers and consultancies last week were showcasing wide-ranging use cases of 5G.