Trustwave Rapid Response: CrowdStrike Falcon Outage Update. Learn More

Trustwave Rapid Response: CrowdStrike Falcon Outage Update. Learn More

Services
Capture
Managed Detection & Response

Eliminate active threats with 24/7 threat detection, investigation, and response.

twi-managed-portal-color
Co-Managed SOC (SIEM)

Maximize your SIEM investment, stop alert fatigue, and enhance your team with hybrid security operations support.

twi-briefcase-color-svg
Advisory & Diagnostics

Advance your cybersecurity program and get expert guidance where you need it most.

tw-laptop-data
Penetration Testing

Test your physical locations and IT infrastructure to shore up weaknesses before exploitation.

twi-database-color-svg
Database Security

Prevent unauthorized access and exceed compliance requirements.

twi-email-color-svg
Email Security

Stop email threats others miss and secure your organization against the #1 ransomware attack vector.

tw-officer
Digital Forensics & Incident Response

Prepare for the inevitable with 24/7 global breach response in-region and available on-site.

tw-network
Firewall & Technology Management

Mitigate risk of a cyberattack with 24/7 incident and health monitoring and the latest threat intelligence.

Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Microsoft Exchange Server Attacks
Stay protected against emerging threats
Rapidly Secure New Environments
Security for rapid response situations
Securing the Cloud
Safely navigate and stay protected
Securing the IoT Landscape
Test, monitor and secure network objects
Why Trustwave
About Us
Awards and Accolades
Trustwave SpiderLabs Team
Trustwave Fusion Security Operations Platform
Trustwave Security Colony
Partners
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Trustwave PartnerOne Program
Join forces with Trustwave to protect against the most advance cybersecurity threats

Ransomware, Supply Chain & Tech Threats Explode – 2024 Trustwave SpiderLabs Report

Trustwave SpiderLabs, in its just-released report 2024 Professional Services Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies, has uncovered an increasing number of ransomware, third-party supplier, and technology-based attacks targeting the professional services sector.

The professional services sector, which includes consulting, business, management consulting, accounting, and legal services for this report, is a prime target for threat actors due to the treasure trove of information these businesses contain. This data can range from intellectual property to legal documents to client personally identifiable information (PII), which can be sold on the Dark Web or used to launch additional attacks.

Beyond the possibility of having an organization or firm physically impacted or knocked offline, a cyberattack has the potential to do an untold amount of reputational damage, which in the long run, could destroy the victim's ability to conduct business. Additionally, many professional services firms must adhere to federal, state, and local compliance regulations that, if broken or abused through a cyberattack, can cause additional financial loss and stress on the business and its leadership.

"In today's digital landscape, a cybersecurity breach for professional services firms isn't just an inconvenience, it can be catastrophic," said Trustwave Global CISO Kory Daniels. "The financial losses from recovery, legal fees, and potential fines are just the tip of the iceberg. The severe reputational damage can erode years of client trust and stall future business. Operational disruptions, employee stress, and increased regulatory scrutiny further compound these challenges. This is why robust cybersecurity is no longer optional, it's a critical priority for these information-rich firms.

 

The Threats Facing Professional Services

The Trustwave SpiderLabs report notes that many threats facing professional services providers overlap with those with which the healthcare, financial, manufacturing, and other sectors deal. However, each threat has a slightly different spin in this category.

  • Ransomware: Professional services and legal entities have experienced a significant surge in ransomware attacks, with at least 142 firms being victimized over the past year with the US being hardest hit. This is likely because professional services firms and legal companies from the US are often seen as prime targets for ransomware attacks due to their perceived financial resources compared to businesses in other regions. This supposed capability leads cybercriminals to believe these firms are more likely to pay larger ransoms to swiftly restore access to critical data and reduce operational disruptions, thereby increasing their attractiveness as targets for extortion.

  • Supply Chain Exposure: Cybercriminals are increasingly targeting trusted third-party vendors used by professional services and legal firms. This approach allows them to gain a backdoor into the target companies' data through a less secure vendor. Since these firms often act as third parties themselves and rely heavily on various external software, consultants, and contractors, it creates numerous potential entry points for attackers.

  • Emerging Technology: By adopting new technology or moving to the cloud, professional services firms have inadvertently opened themselves up to attacks. Trustwave SpiderLabs noted that merging technologies often lack a mature security track record, meaning vulnerabilities may not be fully understood or patched creating a larger attack surface for cybercriminals to exploit. For example, several professional services firms have experienced security issues after migrating to cloud platforms, often due to misconfigured cloud storage settings, inadequate access controls, or employee training on cloud security best practices.

Interestingly, Trustwave SpiderLabs found Lockbit and Blackcat/ALPHV among the most active threat actors, although this may change in the future as each was disrupted by recent law enforcement actions. These groups remain the top two most active ransomware operators, with only slight differences in the frequency of reported incidents. The third position is now occupied by the 8Base group.

All attack groups use the same bag of tricks for attacking professional service organizations as other sectors. Phishing, Business Email Compromise, exploiting vulnerabilities, various types of malware, and gaining access via access and data brokers who operate on the Dark Web. However, while the tactics are similar, threat groups put a special spin on them when used against a professional services firm.

For example, Trustwave SpiderLabs researchers have monitored attorney impersonation scams. Attorney impersonation involves pretending to be a legal representative of a vendor company or law firm to deceive victims with fake invoices, directing payments to attackers' bank accounts. Scammers use a similar method, pretending to be debt recovery officers, and esignature platforms like DocuSign and Adobe Sign, commonly used in professional services circles, luring people into clicking malicious links.

Additional examples, along with security recommendations and mitigations, are included in the report.

 

Trustwave SpiderLabs Industry Report Series

The professional services sector report is the latest in a series researched and published by Trustwave SpiderLabs. Please visit these for an in-depth analysis of the security issues facing each industrial sector:

Please download the 2024 Professional Services Threat Landscape: Trustwave Threat Intelligence Briefing and Mitigation Strategies for all the background details on these threats, the groups behind them, and how to properly defend your professional services firm.

Latest Trustwave Blogs

De-Risk Technology Transitions and Save Money with Trustwave

With all the issues happening in cybersecurity technology lately, such as CrowdStrike’s software update that caused massive outages worldwide last week, it behooves all organizations to take a...

Read More

How Cybercriminals Use Breaking News for Phishing Attacks

Trustwave SpiderLabs issued a warning that threat actors may attempt to take advantage of CrowdStrike’s software update that caused widespread outages by using the news as the center of a social...

Read More

Trustwave Response: CrowdStrike Falcon Outage Update

Trustwave is proactively assessing and monitoring our clients who may have been impacted by CrowdStrike’s recently rolled-out update for its Windows users. The critical issue identified with...

Read More