{"id":17167,"date":"2024-03-06T21:43:46","date_gmt":"2024-03-06T13:43:46","guid":{"rendered":"https:\/\/www.microdium.com\/public\/?p=17167"},"modified":"2024-03-06T21:43:46","modified_gmt":"2024-03-06T13:43:46","slug":"sr-022-022024-mycert-report-cyber-incident-quarterly-summary-report-q1-2023","status":"publish","type":"post","link":"https:\/\/www.microdium.com\/public\/2024\/03\/06\/sr-022-022024-mycert-report-cyber-incident-quarterly-summary-report-q1-2023\/","title":{"rendered":"SR-022.022024: MyCERT Report – Cyber Incident Quarterly Summary Report – Q1 2023"},"content":{"rendered":"

1.0 Introduction<\/strong><\/p>\n

The\u00a0Cyber Incident Quarterly Summary Report – Q1 2023\u00a0\u00a0provides an overview of computer security incidents handled by the Cyber999 Incident Response Centre of CyberSecurity Malaysia in Q1 2023. This quarterly Cyber Incident Report also highlights statistics of incidents handled by Cyber999 Incident Response Centre in Q1 2023 according to their\u00a0categories, as well as the list of security advisories released in this quarter. It should be noted that the statistics provided in this report reflect only the total number of incidents reported and handled by the\u00a0Cyber999 Incident Response Centre, excluding elements such as monetary value or aftermaths of the incidents. Computer security incidents handled by the\u00a0Cyber999 Incident Response Centre\u00a0are those involving IP addresses and domains originating from Malaysia.\u00a0 We also work closely with ISPs, CERTs, Special Interest Groups (SIGs) and Law Enforcement Agencies (LEAs), from local and international, to remediate and mitigate computer security incidents in Malaysia.<\/p>\n

 <\/p>\n

2.0 Trends Q1 2023<\/strong><\/p>\n

The number of Malaysian Internet users in Malaysia has increased to\u00a033.03 million\u00a0at the start of 2023. As of January 2023, the estimated number of social media users in Malaysia is\u00a026.80 million equating to\u00a078.5 percent\u00a0of the total\u00a0population.<\/p>\n

In general, the\u00a0Cyber999\u00a0Incident Response Centre\u00a0receives incident reports from local individuals, including\u00a0Internet users and members of the public, as well as from industries, government, academia, and non-profit organisations (NGOs). We also proactively seek and gather insights on cyber threats that could impact Internet users and organisations in Malaysia and aid in mitigating these threats.<\/p>\n

The Cyber999\u00a0Incident Response Centre\u00a0received 1,290 incidents in Q4 2022. In comparison, Q1 2023 received a total of 1,307 incidents, indicating a 13% increase compared to Q4 2022.<\/p>\n

Table 1 to Table 3 below provide details of the reported incidents in Q1 2023 and Q4 2022.<\/p>\n

Table 1: Comparison of total incidents between Q4 2022 and Q1 2023<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Categories of Incidents<\/td>\nQuarters<\/td>\nPercentage (%)<\/td>\n<\/tr>\n
Q4 2022<\/strong><\/td>\nQ1 2023<\/strong><\/td>\n<\/tr>\n
Data Breach<\/td>\n19<\/td>\n102<\/strong><\/td>\n437<\/td>\n<\/tr>\n
DoS<\/td>\n3<\/td>\n3<\/strong><\/td>\n0<\/td>\n<\/tr>\n
Fraud<\/td>\n819<\/td>\n797<\/strong><\/td>\n-2.7<\/td>\n<\/tr>\n
Intrusion<\/td>\n158<\/td>\n157<\/strong><\/td>\n-1<\/td>\n<\/tr>\n
Intrusion Attempt<\/td>\n41<\/td>\n56<\/strong><\/td>\n37<\/td>\n<\/tr>\n
Malicious Codes<\/td>\n163<\/td>\n140<\/strong><\/td>\n-14<\/td>\n<\/tr>\n
Spam<\/td>\n70<\/td>\n24<\/strong><\/td>\n-66<\/td>\n<\/tr>\n
Vulnerabilities Report<\/td>\n17<\/td>\n28<\/strong><\/td>\n65<\/td>\n<\/tr>\n
TOTAL<\/strong><\/td>\n1290<\/td>\n1307<\/strong><\/td>\n13<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

 <\/p>\n

Table 2: Number of incidents based on months in Q1 2023<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n
Categories of Incidents<\/td>\nJan<\/td>\nFeb<\/td>\nMac<\/td>\n<\/tr>\n
Denial of Service<\/td>\n0<\/td>\n1<\/td>\n2<\/td>\n<\/tr>\n
Fraud<\/td>\n235<\/td>\n272<\/td>\n340<\/td>\n<\/tr>\n
Vulnerabilities Report<\/td>\n10<\/td>\n9<\/td>\n9<\/td>\n<\/tr>\n
Intrusion<\/td>\n72<\/td>\n39<\/td>\n46<\/td>\n<\/tr>\n
Intrusion Attempt<\/td>\n22<\/td>\n17<\/td>\n17<\/td>\n<\/tr>\n
Malicious Codes<\/td>\n24<\/td>\n45<\/td>\n71<\/td>\n<\/tr>\n
Data Breach<\/td>\n12<\/td>\n37<\/td>\n53<\/td>\n<\/tr>\n
Spam<\/td>\n13<\/td>\n6<\/td>\n5<\/td>\n<\/tr>\n
TOTAL<\/strong><\/td>\n388<\/td>\n376<\/td>\n543<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

 <\/p>\n

Table 3: Number of sub-categories of\u00a0incidents based on months in Q1 2023<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Categories of Incidents<\/td>\nJan<\/td>\nFeb<\/td>\nMar<\/td>\n<\/tr>\n
Denial of Service<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Denial of Service \u2013 DoS<\/td>\n1<\/td>\n2<\/td>\n4<\/td>\n<\/tr>\n
Fraud<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Fraud — Bogus Email<\/td>\n1<\/td>\n3<\/td>\n6<\/td>\n<\/tr>\n
Fraud \u2013 Business Email Compromise<\/td>\n0<\/td>\n1<\/td>\n1<\/td>\n<\/tr>\n
Fraud \u2013 Fraud Site<\/td>\n20<\/td>\n37<\/td>\n75<\/td>\n<\/tr>\n
Fraud \u2013 Impersonation & Spoofing<\/td>\n3<\/td>\n5<\/td>\n6<\/td>\n<\/tr>\n
Fraud \u2013 Job Scam<\/td>\n4<\/td>\n5<\/td>\n13<\/td>\n<\/tr>\n
Fraud \u2013 Lottery Scam<\/td>\n0<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
Fraud \u2013 Love\/Parcel Scam<\/td>\n1<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
Fraud — Phishing<\/td>\n206<\/td>\n171<\/td>\n239<\/td>\n<\/tr>\n
Vulnerabilities Report<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Vulnerabilities Report \u2013 Misconfiguration Disclosure<\/td>\n6<\/td>\n6<\/td>\n2<\/td>\n<\/tr>\n
Vulnerabilities Report — System<\/td>\n2<\/td>\n2<\/td>\n4<\/td>\n<\/tr>\n
Vulnerabilities Report — Web<\/td>\n2<\/td>\n1<\/td>\n3<\/td>\n<\/tr>\n
Intrusion<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Intrusion \u2013 Account Compromise<\/td>\n3<\/td>\n0<\/td>\n3<\/td>\n<\/tr>\n
Intrusion — Defacement<\/td>\n69<\/td>\n39<\/td>\n43<\/td>\n<\/tr>\n
Intrusion Attempt<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Intrusion Attempt \u2013 Login Brute Force<\/td>\n3<\/td>\n1<\/td>\n6<\/td>\n<\/tr>\n
Intrusion Attempt \u2013 Port Scanning<\/td>\n3<\/td>\n4<\/td>\n3<\/td>\n<\/tr>\n
Intrusion Attempt \u2013 Vulnerability Probes<\/td>\n16<\/td>\n12<\/td>\n8<\/td>\n<\/tr>\n
Malicious Codes<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Malicious Codes \u2013 Botnet C&C<\/td>\n1<\/td>\n0<\/td>\n2<\/td>\n<\/tr>\n
Malicious Codes \u2013 Bots<\/td>\n0<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
Malicious Codes \u2013 Malware<\/td>\n20<\/td>\n44<\/td>\n65<\/td>\n<\/tr>\n
Malicious Codes \u2013 Malware Hosting<\/td>\n3<\/td>\n1<\/td>\n4<\/td>\n<\/tr>\n
Content Related<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Content Related \u2013 Data Breach<\/td>\n12<\/td>\n37<\/td>\n53<\/td>\n<\/tr>\n
Spam<\/td>\n <\/td>\n <\/td>\n <\/td>\n<\/tr>\n
Spam \u2013 Spam<\/td>\n8<\/td>\n6<\/td>\n5<\/td>\n<\/tr>\n
Spam \u2013 Spam Relay<\/td>\n5<\/td>\n0<\/td>\n0<\/td>\n<\/tr>\n
TOTAL<\/strong><\/td>\n388<\/td>\n376<\/td>\n543<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

 <\/p>\n

Figure\u00a01 illustrates and provides an overview of the number of incidents reported in Q1 2023, in a chart. Figure 2 illustrates the percentage of incidents based on their classification.<\/p>\n

\"\/var\/folders\/6z\/hkzvrwr1051ffchpgxsxv2bhvy2bzg\/T\/com.microsoft.Word\/Content.MSO\/BC8EB4BA.tmp\"<\/strong><\/p>\n

Figure 1: Breakdown of reported incidents from Jan to Mac 2023<\/p>\n

 <\/p>\n

\"\/var\/folders\/6z\/hkzvrwr1051ffchpgxsxv2bhvy2bzg\/T\/com.microsoft.Word\/Content.MSO\/1F18CD8.tmp\"\u00a0<\/strong><\/p>\n

Figure 2: Percentage of reported incidents by classification<\/p>\n

 <\/p>\n

Based on the above statistics, there is\u00a0a trend in which a few incidents reported to us have increased in Q1 2023 compared to Q4 2022, with two incidents (Spam and DDOS) remaining low. The one incident, data breach showed an increase of 437% from Q4 2022. For the total incident of Q1 2023, the topmost reported incident is fraud, representing (60.98%) of the total number of\u00a0reported incidents to us. This is followed by intrusion (12.01%), malicious code(10.71%), and data breach (7.8%).<\/p>\n

Based on the current trends, data breach incidents will most likely continue to grow in Malaysia in 2024. They will always be among the top 4 reported incidents to the Cyber999\u00a0Incident Response Centre\u00a0if organisations and Internet users do not take proper security measures to prevent data breaches.<\/p>\n

The types of data\u00a0breaches reported to us are\u00a0as in\u00a0the below table:<\/p>\n

Table 4: Type of reported data breach incidents<\/p>\n

\n\n\n\n\n\n\n
Type of Data Breach<\/td>\nDescription<\/td>\n<\/tr>\n
PII<\/td>\nPersonal data identification such as fullname, IC, address, age, telephone number, salary<\/td>\n<\/tr>\n
Email Credential<\/td>\nUsername and password of email account<\/td>\n<\/tr>\n
Appliances Credential<\/td>\nAdmin panel access, Joomla, wordpress, ftp access, wp-admin access and etc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

 <\/p>\n

Meanwhile, for fraud incidents besides\u00a0phishing URLs, new tactics and techniques of current scams that concatenate social engineering and malicious code could potentially continue to grow in Malaysian cyberspace.<\/p>\n

 <\/p>\n

2.1 Top Fraud Incidents Reported by Malaysian Internet Users to CyberSecurity Malaysia<\/strong><\/p>\n

Scam activities and fraud continuously prevail within the community, targeting various citizens, from students to professionals. It has become a preferred method of criminals as awareness is still lacking among the public, making them an easier target. A total of\u00a0797\u00a0fraud incidents were handled in this quarter, representing a decrease of 2.7% compared to Q4 2022. All the incidents were received from organisations and public users. The top fraud incidents reported to the\u00a0Cyber999 Incident Response Centre are as below:<\/p>\n