BlueVoyant Report Reveals US Supply Chain is Under Siege as Ransomware Attacks on Shipping and Logistics Firms Triple

Threat Actors Capitalize on Common Vulnerabilities in the Midst of COVID-19 Vaccine Distribution Effort

News provided by

Apr 22, 2021, 09:00 ET

NEW YORK, April 22, 2021 /PRNewswire/ -- BlueVoyant, a cybersecurity services company, today announced the findings from its newest report: Supply Chain Disruptions and Cybersecurity in Logistics. As Global health is dependent upon the immediate, safe and effective distribution of the COVID-19 vaccine, logistics firms are literally carrying the world through the current crisis. Underscoring its vulnerability to attack, US Policymakers have put a spotlight on cybersecurity in the supply chain with recent Executive Orders enacted to secure maritime shipping and logistics.

Ransomware the Number One Cyber Threat to the Supply Chain

It is undisputed that the largest cybersecurity threat facing supply chain and logistics companies today is neither nation-state attacks nor data breach information for sale on the dark web; it is ransomware. This report shows that from 2019 to 2020, ransomware attacks on shipping and logistics firms tripled—with almost all attacks resulting from phishing or exploitation of open remote desktop ports—making the sector especially vulnerable during the critical global vaccine rollout.

Using open-source data and proprietary research, BlueVoyant assessed 20 of the top global shipping and logistics companies to understand their vulnerability to ransomware and other disruptive attacks. The results indicate the growing threats facing the sector—specifically the disproportionate impact of rising ransomware attacks—capable of bringing businesses that operate technology-driven and highly automated 'just-in-time' delivery schedules to a standstill.

Key Report Findings:

Ransomware is the #1 cyber threat to logistics companies today, suggesting a situation of imminent and extreme risk.
Malicious actors are keenly interested in logistics companies. 100% of the companies assessed saw some evidence of threat targeting against their network.
Despite the risks of ransomware attacks, 90% of the organizations studied were found to have open remote desktop or administration ports and insufficient email security, the primary vulnerabilities to ransomware gangs.
Other evidence of threatening activity was also observed, including:

Evidence of brute force attacks
Targeted attacks using proxy networks
Traffic to blocklisted/denylisted assets
Traffic coming from known botnets

Many processes and technologies in the sector are out of date, leaving firms needlessly exposed to vulnerabilities, remedied by easily hardened attack channels.

Unprotected Networks Vulnerable to Phishing/Spoofing Attacks

BlueVoyant's assessment indicates the immediate need for shipping and logistics companies to dramatically improve IT hygiene and email security. This is clearly underscored by the fact that 90% of the companies studied had open remote desktop or administration ports at IP addresses on their network, and most appeared to have email security vulnerabilities. The report also shows that domains belonging to 14 of the 20 companies studied have no protection against phishing and spoofing attacks, 16 of the 20 companies have devices running unsupported software on their networks and half of the companies appear to be running software with high-severity vulnerabilities on their servers.

COVID-19 Vaccine Delivery Focuses Attackers on Supply Chain

High-profile cargo like the COVID-19 vaccine—and the data that goes with it—make shipping and logistics companies high-value targets to cybercriminal and national state actors aiming to disrupt government efforts and steal sought-after vaccine data. This places additional burden on a sector that, in the past, has already faced significant disruption from cyberattacks. Consider the 2017 global NotPetya ransomware attack that froze Danish shipping firm Maersk's worldwide logistics operations, costing the firm a whopping $250-300m.

Commenting on the research, Thomas Lind, Head of Strategic Intelligence, BlueVoyant said: "IT management issues, such as those observed in our assessment, played a key role in NotPetya's infection of Maersk's systems; an especially damaging case which served as a violent wake-up call for the logistics industry. Alarmingly, more than four years later, the sector remains vulnerable to malicious cyber activity, and specifically vulnerable to ransomware attacks."

Securing America's Supply Chain
In February of this year, the Biden administration signed an Executive Order on America's Supply Chains to secure and bolster the American supply chain and mitigate its vulnerability to attack, highlighting its critical role in the delivery of the COVID-19 vaccine. There are also a number of actions logistics and supply chain companies should immediately implement to mitigate against future attacks and improve their operational preparedness. These include securing email services and mail servers against phishing and spoofing, securing port and network configurations, updating and patching software, being aware of OFAC regulations and utilizing advanced security services to protect against the multi-faceted and evolving threat landscape.

Jim Rosenthal, co-founder and CEO, BlueVoyant, concludes: "Widespread vulnerabilities persist at a time of increased scrutiny and critical reliance on supply chains; as countries around the world wait for efficient and safe vaccine distribution programs, and as entire work-from-home economies rely heavily on global shipping. The Biden Executive Order demonstrates increased national focus on and critical support for this sector. Given the sensitivity of distribution networks to disruption, the global reliance on supply chain businesses, and the lingering warning of the NotPetya attack, it is a critical and immediate imperative for this sector to become more resilient against ongoing cyber threats."

BlueVoyant is an expert-driven cybersecurity services company whose mission is to proactively defend organizations of all sizes against today's constant, sophisticated attackers, and advanced threats.

Led by CEO, Jim Rosenthal, BlueVoyant's highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200 and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.

Founded in 2017 by Fortune 500 executives, including Executive Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, San Francisco, Manila, Toronto, London, Latin America and Budapest.

BlueVoyant Press Contacts:
Danielle Ostrovsky
C8 Consulting (Americas)
T: 001 410-302-9459
E: [email protected]

Jim Pople
C8 Consulting (EMEA)
T: +44 7955 030191
E: [email protected]

SOURCE BlueVoyant