The United States is a focal point for cyber threats, offering the highest potential gain to threat actors worldwide. Unquestionably, it remains the most targeted country worldwide. Ransomware, poses a particularly severe threat to organizations globally, with the U.S. being its primary target. In light of these realities, this comprehensive threat landscape report aims to shed light on the specific cyber threats that the nation faces.

Just two months ago, researchers from Vienna conducted a study that revealed the abuse of dangling DNS records to hijack subdomains of numerous major organizations, highlighting the potential vulnerability of thousands of entities. The researchers targeted subdomains belonging to various government organizations, political parties, universities, media companies, and financial institutions. They managed to take control of these subdomains to demonstrate the risk associated with this vulnerability.

It would be great if Dark Web scans were as simple as Google searches – if you could simply plug your business’s name into a search engine, run a query and view a list of results about threats that impact your company. Unfortunately for businesses seeking to stay a step ahead of threat actors, quite the opposite is true. It’s not just that there is no Google or search index that teams can turn to when searching for threats.

On September 15th, 2023, it was announced that a company in Stockport, UK, responsible for producing ID cards for various organizations, including Greater Manchester Police, fell victim to a ransomware attack. The attack, conducted using ransomware, had significant implications. Thousands of police officers’ personal details, including their names, were at risk of exposure to the public domain.

You can’t manage what you can’t measure – and unfortunately, measuring cyber risk exposure can be quite difficult. That’s not, of course, because no one attempts to put labels on risks and threats. In fact, there is a great deal of effort placed on identifying, quantifying, and deciding how to manage cyber risk.

The financially motivated Desorden (Disorder in Spanish) group, previously known as “chaoscc”, was first observed going by the new name Desorden in 2021 while acting against multiple Asian-based organizations in various sectors. The group mainly targets high-revenue enterprises and supply chains to amass as much profit as possible by extracting sensitive organizational data and demanding a ransom for it.

Android, an operating system developed by Google, has become a staple in our lives, powering smartphones, car systems, tablets, and much more. With over 70% of the mobile OS market share and embedded in over 1.5 billion devices worldwide, the Android platform is an enticing target for threat actors.

Qakbot, also known as Pinkslipbot, Qbot and Quakbot, is a notorious Banking Trojan designed to steal account credentials and online banking session information leading to account takeover fraud. Commonly distributed via malicious unsolicited email (malspam), Qakbot campaigns reportedly deployed ‘Cobalt Strike’ beacons likely in an attempt to move laterally as well as gaining persistency and establishing a robust communication channel back to the threat actor.