Kaspersky's APT Predictions for 2022: Spyware Vendors, Supply Chains and Bootkits

Kaspersky researchers have set out how they expect advanced persistent threats (APTs) to change in 2022. Their forecast includes politics playing a bigger part in cyberspace, a comeback for low-level attacks, a wave of new APT groups and more supply chain attacks.

According to Kaspersky, the events of 2021 will shape how sophisticated attacks develop over the following year. The company's Global Research and Analysis Team (GReAT) based the forecast on trends it tracked through 2021, with the aim of helping the IT community get ready for what comes next.

Commercial spyware feeding new APT groups

Surveillance software built by private vendors drew heavy attention in 2021. Project Pegasus overturned assumptions about how likely real-world zero-day attacks on iOS were. The researchers also saw makers of advanced surveillance tools strengthening their ability to avoid detection and resist analysis, as with FinSpy, and deploying those tools in the wild, as with the Slingshot framework.

Commercial surveillance software can reach large volumes of personal data and a broad range of targets. That makes it profitable for the companies selling it and effective for the threat actors using it. Kaspersky's experts therefore expect these vendors to keep expanding and to sell their services to new advanced threat actors until governments start regulating the market.

Other predictions for targeted threats

Broad, sophisticated attacks on mobile devices. Phones have always appealed to attackers: they go everywhere with their owners, and each one holds a great deal of valuable information. More zero-day attacks on iOS were seen in the wild in 2021 than ever before. On a PC or Mac a user can install a security suite, but on iOS such products are restricted or unavailable, which Kaspersky says gives APTs exceptional openings.

A rise in supply chain attacks. The researchers noted how often attackers used weak security at a vendor to compromise that vendor's customers. These attacks pay off well because they open the door to many potential targets at once, so Kaspersky expects them to keep increasing into 2022.

Home working still being exploited. As remote work continues, criminals will keep using employees' unprotected or unpatched home computers as a route into corporate networks. Social engineering to steal credentials, and brute-force attacks on corporate services to break into poorly protected servers, will carry on.

More APT intrusions in the META region, particularly Africa. Geopolitical tension in the region is rising, and cyber espionage with it. Defences there are also getting steadily better and more sophisticated. Together, Kaspersky says, these trends point to Africa as the main target of APT attacks within META.

A surge in attacks on cloud security and outsourced services. Many businesses are adopting cloud computing and microservice-based software running on third-party infrastructure, which is easier to hack. The researchers expect this to make a growing number of companies prime targets for sophisticated attacks.

Low-level attacks return, with bootkits back in fashion. Secure Boot is becoming more common on desktops, pushing attackers to hunt for exploits or new flaws that let them get around it. Kaspersky therefore expects the number of bootkits to grow in 2022.

States define which cyber offences they accept. Governments increasingly condemn cyber attacks against themselves while carrying out their own. The researchers predict that some countries will publish a taxonomy of cyber offences in 2022, setting out which attack vectors they consider acceptable.

Why Kaspersky publishes the forecast

Ivan Kwiatkowski, senior security researcher at Kaspersky, said dozens of events change cyberspace every day, and those changes are hard to follow and harder still to predict. Even so, he said, the company's experts have correctly anticipated many cybersecurity trends for several years. He described it as essential to keep monitoring APT activity, to assess the effect of targeted campaigns and to share what is learned with the wider community, in the hope of helping users be better prepared for what lies ahead.

The predictions draw on Kaspersky's threat intelligence services, which are used worldwide, and the full report appears on the company's Securelist site. They form part of the Kaspersky Security Bulletin (KSB), an annual series of predictions and analysis covering major shifts in cybersecurity. Kaspersky published a similar forecast of advanced targeted threats the previous year.