Orange Cyberdefense, the specialist arm of Orange Group dedicated to cybersecurity, has released a new report, Cy-Xplorer 2023, in which it provides a detailed analysis of cyber extortion (Cy-X) activity during 2022.

Examining data from a total of 6,707 confirmed business victims, the findings show a fluctuation in the number of victims across different countries and industries, with attacks expanding to new regions. While the data shows a decrease of Cy-X victims (8%) in 2022, this reduction is short lived as the latest data shows the largest volumes to date in Q1 2023.

As Cy-X attacks continue to rise, the report suggests that 2022 was the year of "distraction" and rebranding for some of the major Cy-X operations Orange Cyberdefense is monitoring.

Incident volumes spike as Cy-X activity broadens to impact previously unaffected countries

The geographical shift of Cy-X attacks has continued, as previously noted in the Security Navigator 2023, with a significant year on year increase (42%) in Southeast Asia; with Indonesia, Singapore, Thailand, Philippines, and Malaysia the most impacted. Simultaneously we have seen a decrease in victims in regions such as North America and Europe.

Previously we observed that countries are mostly targeted opportunistically, and the number of victims depends primarily on the number of organizations registered in a country. However, this general trend is changing as bigger western countries respond actively to the threat, and threat actors are forced to seek out new hunting grounds. As such, threat actors are focusing on regions where the level of risk seems lower for them, which could partly be due to a lack of proactivity from local governments.

Threat actors changing tactics – moving from manufacturing to utilities and education

In 2022 manufacturing was the biggest industry impacted, with roughly one fifth of all victims within this industry. However, in 2022 we observed a decrease of 39% for the manufacturing sector, with the second half of 2022 showing a noticeably lower number of victims. One reason for this sharp decline is most likely the closure of the Conti group’s criminal activities.

The educational sector has suffered much more in 2022 when compared to the year before, with an increase of 41%. And particularly at the hands of the Vice Society group. We saw an average of 10 organizations per month from this sector being publicly exposed on the dark web, with the top five countries impacted being the US, UK, Spain, France and Australia.

We also observe that the utilities sector saw an increase of 51%, but the actual numbers of observed victims in 2022 remained low (35 victims).

The report also highlights how the financial sector has seen an increase of Cy-X attacks, (+11%) with over 130 financial institutions becoming victims of Cy-X. 75% of all victims have under 1,000 employees.

With regard to business size, in 2022, we saw large organizations impacted the most, representing 36% of all victims, but small and medium organizations were not far behind. We recorded that 30% of all victims were small organizations, while medium-sized businesses made up 24%.