Cybercriminals are taking advantage of the world’s sprawling, complex supply chains in a practice known as ‘island hopping’.
In a cybersecurity context, island hopping is when attackers gain access to part of an organisation’s network and then use it to attack other systems within the network, as well as separate – but associated – companies.
Go deeper with GlobalData
The goal isn’t to hop in and out – it is to stick around and pivot into a more lucrative company’s network.
According to Massachusetts-based cybersecurity firm Carbon Black, 50% of all cyberattacks leverage island hopping.
“Attackers are fighting back,” says Carbon Black’s chief cybersecurity officer, Tom Kellermann, in the company’s Global Incident Response Threat Report.
“They have no desire to leave the environment. And they don’t just want to rob you and those along your supply chain. In the parlance of the dark web, attackers these days want to ‘own’ your entire system.”
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataIn today’s cyber landscape it isn’t enough for a company to ensure its own systems are protected – the cyber robustness of its partners and vendors matters, too.
With island hopping, attackers target the weakest link in the chain. That in itself has given rise to companies that rank the cyber hygiene of companies – such as SecurityScorecard – so that companies know who to do business with and who to steer clear from.
“Businesses need to be mindful of companies they’re working closely with and ensure that those companies are doing due diligence around cybersecurity as well,” said Thomas Brittain, who leads Carbon Black’s Global IR Partner Program.
Top targets for island hopping cyberattacks
Unsurprisingly, the financial industries is the biggest target for island hopping cyberattacks. Of the 40 Carbon Black incident response partners surveyed, 47% said they had encountered the method – also known as leapfrogging – in the financial sector.
Following closely behind is the manufacturing industry, with 42% of respondents coming across island hopping cyberattacks in this sector. Often the purpose here is to steal intellectual property and sell it on for profit on the black market: 22% of respondents said this was the attacker’s end goal.
“Going after manufacturing companies for IP [intellectual property] purposes reduces R&D costs for designing everything from aeroplanes, to cell phones, to high-grade weapons,” said Ryan Cason, director of partner success at Carbon Black.
“It allows them to get to market quicker, at a cheaper price point, to the detriment of their victim.”
The three types of island hopping
According to Carbon Black there are three types of island hopping:
- Network-based island hopping
The typical example, in which attackers ‘hop’ onto an affiliate network.
- Websites converted into a watering hole
A company website frequented by employees is infected with malware, spreading the infection among devices in the network used to access the site.
- Reverse business email compromise (BEC)
Attackers take control of the mail server of a company and send emails containing malware to trusted partners.
Carbon Black says that main reasons organisations are vulnerable to island hopping is because of a lack of visibility – i.e. a lack of tools to spot the threat.
“At this point, it’s become part and parcel of a cybercrime conspiracy,” said Kellermann. “They’re using their victim’s brand against customers and partners of that company. They’re not just, say, invading your house — they’re setting up shop there, so they can invade your neighbours’ houses too.”
Read more: Beyond the honeypot: How military-inspired deception tactics are snaring cybercriminals
