This new group makes the case that – as with any market – cybercriminals will focus on a niche sector they are experts on in order to improve their chances of success.
Haven’t heard of Daxin Team? That’s probably because they’re doing what most new businesses do in a saturated market: focus on a subset of that market. In Daxin Team’s case, it’s a two-pronged definition, according to a recent alert from the Cybersecurity & Infrastructure Security Agency:
- They are targeting the Healthcare and Public Health (HPH) Sector
- They are focused on gaining initial access to victims through unpatched vulnerabilities in virtual private network (VPN) servers
The targeting of the HPH sector isn’t the interesting part; the initial access is. Historically, RDP compromise and phishing-based attacks have been flip-flopping 1st position as the most-used initial attack vector since 2018, according to ransomware response vendor Coveware. What’s fascinating is that the Coveware data shows a steady incline in the use of software vulnerabilities – something that includes vulnerabilities on VPN servers. The Daxin Team gang is a great practical example of that – and why organizations need to ensure every system that is externally accessible in any way possible is kept completely up to date.
But with phishing still the dominant leader in initial attack vectors, it’s equally necessary to make certain users aren’t engaging with potentially malicious content in email and on the web – something taught using continual Security Awareness Training.
