Skip to content

Malware Threat Research 2020-2023

If you ask Google or AI what malware is, they’ll likely break it down as software meant to disrupt your systems, networks, or devices — but this description alone might not convince you of its significant threat.

Contents:

Your perspective on malware is likely to change when you engage with someone who has suffered greatly because of it or once you delve into the latest facts on cyber attacks. It’s in these moments that you truly grasp the reality of malware as a legitimate and substantial threat.

In collaboration with independent third-party researchers, we analyzed cybersecurity incident data from January 2020 to September 2023 to assess and show you how big of a threat malware is today.

Here’s what we discovered…

Key findings from the research

1. With nearly 3 million attacks in 2023, malware has spread like a biological virus

While you may not find it surprising that the number of malware attacks has increased over the last few years, the speed at which this issue has been escalating might catch you off guard.

In 2020, approximately 614,144 malware-related incidents were reported. However, this number surged to 2,898,142 in 2021 and nearly doubled again in 2022, reaching 4,858,963. As you can see, these are not minor differences but massive leaps highlighting a substantial increase in the scale of the problem.

number of malware attacks 2020-2023 graph

In 2023, there were 2,678,841 malware attacks reported. However, before you assume that this signals a gradual resolution of the problem, let us highlight some details that — unfortunately — indicate it’s not yet time to celebrate.

To start, the malware incident data we’ve examined covers only the first 9 months of 2023, implying that the total number of cases for the entire year will more than likely be higher.

Moreover, a troubling trend observed by numerous IT experts is the increasing frequency of successful attacks. This indicates that cybercriminals are employing more and more sophisticated hacking methods and focusing on more targeted approaches. Simply put, this means we’re observing fewer malware attacks overall, but more of them are accurate. This is further evidenced by the continuous growth in the number of successfully executed unique email attacks, as depicted in the graph below.

number of successful unique email attacks graph

How does malware spread? Email is a common culprit, where spam and phishing tricks convince users to click on harmful links or download infected attachments. Careless browsing, like clicking on pop-ups, can also lead to visiting malicious websites that stealthily download malware.

Within organizations, coworkers clicking on malicious links can spread malware through the internal network, infecting multiple devices at the same time. Another risk comes from bundled software, where malware sneaks in with seemingly trustworthy downloads, causing users to unknowingly install various harmful programs — from annoying adware to data-stealing spyware.

2. Brazil, the USA, and India have the most malware-affected users

In the analysis of cybersecurity incidents, the focus was also on examining the global distribution of cases related to malware. Presented below are the top 15 countries with the highest number of malware-affected users (drawing from data spanning from October 2020 to November 2023):

  1. Brazil — 9,659,846 affected users

  2. USA — 6,966,426 affected users

  3. India — 6,914,742 affected users

  4. Indonesia — 5,354,246 affected users

  5. Vietnam — 3,611,798 affected users

  6. Egypt — 3,516,376 affected users

  7. Mexico — 3,042,467 affected users

  8. The Philippines — 2,926,483 affected users

  9. Turkey — 2,888,663 affected users

  10. Pakistan — 2,849,788 affected users

  11. Columbia — 2,655,695 affected users

  12. Thailand — 2,523,671 affected users

  13. Argentina — 2,300,732 affected users

  14. Peru — 2,215,622 affected users

  15. France — 2,142,316 affected users

Despite securing the top rank in the 2020 Global Cybersecurity Index (GCI) with a score of 100 index points, the United States of America holds second place for the most users impacted by malware — with a staggering number equivalent to the entire population of Massachusetts. Notably, five other nations in the Americas and seven in Asia are grappling with the impacts of the malware situation.

The study also reveals that France takes the lead for the highest number of users affected by malware in Europe. This may be attributed to several factors, such as the country’s substantial internet usage (82% of the population) and the increased likelihood of economically and politically charged cyberattacks against French users.

3. RedLine is the most common type of malware

Malware comes in various types and forms like adware, spyware, ransomware, trojan horses, and keyloggers. Each one possesses specific functionalities that can compromise one’s digital security. However, certain types of malware are more popular than others.

According to the research, the most prevalent types of malware in the last four years have been:

  1. RedLine

    RedLine is a type of malware designed to collect data from web browsers, applications, email and messaging apps, and cryptocurrency wallets. In simple terms, it functions as a remote access trojan, enabling cybercriminals to steal and transfer sensitive user data, which is later sold on the dark web. The research reveals that RedLine attacks constitute 59% of the total records collected — surpassing the runner-up Vidar by 3.2 times.

  2. Vidar

    Vidar is malicious software designed to steal sensitive information, including login credentials, credit card details, cryptocurrency wallets, and browser history, from infected systems. The stolen data can be used for identity theft or financial fraud — or it can be sold on the dark web. As previously noted, RedLine constituted nearly two-thirds of all the analyzed attacks. However, Vidar remains a considerable threat, comprising 18% of the total number of attacks.

  3. Raccoon

    Raccoon, also known as Raccoon Stealer, is a type of information-stealing malware designed to extract sensitive data from the computers of its victims. This includes, but is not limited to, login credentials and credit card information.
    Raccoon Stealer typically spreads through malicious websites, phishing emails, or other deceptive methods. Once it infects a system, it can covertly send the stolen information to a server operated by cybercriminals.
    Raccoon cases account for 12% (21% between July 2022 and April 2023) of malware attacks analyzed for this research.

Other common types of malware include AZORult, CryptBot, Taurus, and Meta.

incidents by malware type graph

Why have these malware types become more widespread? One reason might be that they are easier to create and deploy. Furthermore, using these types of malicious software may offer greater financial rewards for cybercriminals compared to other methods. The popularity of specific malware is also influenced by the constantly evolving landscape of cyber threats, technological vulnerabilities, and shifts in the digital environment.

4. Tens of millions of credential records were stolen from social media and entertainment platforms

Given the widespread practice of storing sensitive data on cloud servers, email accounts, and social media, it comes as no surprise that these platforms are prime targets for cybercriminals. However, the actual numbers will raise a few eyebrows.

So brace yourself for some eye-opening statistics as we explore the top domains associated with the biggest number of data theft incidents caused by malware and unveil the staggering number of records that fell into the wrong hands.

Most targeted domains*:

  1. accounts.google.com – 8.2 million of stolen records

  2. facebook.com – 5.9 million of stolen records

  3. login.live.com – 5.6 million of stolen records

  4. m.facebook.com – 3.2 million of stolen records

  5. Instagram.com — 3.1 million of stolen records

  6. discord.com – 3.1 million of stolen records

  7. netflix.com – 3 million of stolen records

  8. roblox.com – 2.8 million of stolen records

  9. com.facebook.katana – 2.5 million of stolen

  10. records amazon.com – 2.4 million of stolen

  11. records paypal.com – 2.3 million of stolen records

  12. twitter.com – 2.3 million of stolen records

The information above indicates a consistent trend of cybercriminals stealing data from widely used digital platforms. This highlights the necessity for enhanced cybersecurity measures to ensure secure data storage and access.

However, it is ultimately up to the user to take proactive steps to actively educate themselves on protecting their credentials and take appropriate follow-up measures.

*NordPass is not endorsed by, maintained, sponsored by, affiliated, or in any way associated with the owners of the mentioned domains. Domains are listed solely for the purpose of accurately reporting information related to cybersecurity incident data.

What you can do to protect yourself from malware threats

First and foremost, protection against malware – whether for individual users or entire organizations – relies on awareness and a sense of responsibility for implementing appropriate security measures for systems, platforms, and data in use. Therefore, everyone needs to take proactive steps in this regard, as without such engagement, achieving adequate protection becomes challenging.

Here are four actions you can take to enhance your protection against malware:

  1. Raise awareness: By learning about different types of malware and sharing this knowledge with others, you can effectively reduce the risk of being targeted. Awareness campaigns, for example, play a crucial role in helping people identify suspicious activities like phishing emails or dubious website links.

  2. Use antivirus software: Using antivirus software is essential for detecting and removing malware from your devices. A good antivirus constantly scans your system for known malware signatures and behaviors, offering a vital layer of defense against various threats.

  3. Update your systems regularly: Regularly updating your operating system, applications, and firmware is vital as it addresses known security vulnerabilities frequently targeted by malware. These updates typically include security patches and bug fixes, bolstering your system’s defenses against potential cyber threats.

  4. Use a password manager: Using a password manager allows you to create and store unique, complex passwords for each of your accounts, lowering the risk of unauthorized access. By securely storing your credentials, password managers help prevent malware from stealing your login information and accessing sensitive accounts.

How NordPass can help protect your sensitive data and account access

NordPass is a cybersecurity solution designed to help businesses and individuals protect their data and minimize the threat of malware attacks. How so?

First, NordPass is an end-to-end encrypted credentials manager. This means you can use it to securely generate, store, manage, and share passwords, passkeys, credit card information, and personal data — and do so knowing that they are all protected by advanced encryption algorithms.

Second, NordPass facilitates the implementation of single sign-on (SSO) and multi-factor authentication (MFA). You can use it to present employees with a convenient yet highly secure method of logging in to the company accounts.

Third, organizations can use NordPass as an identity and access management (IAM) tool to control and monitor access to company resources in real time. In other words, with NordPass, a company can see exactly who accessed what and when and manage access privileges with ease.

In addition, NordPass goes the extra mile by utilizing a Master Password. Most browser password managers lack this feature, making them more susceptible to malware attacks.

Naturally, our product is equipped with many other features like Autofill, Data Breach Scanner, and Password Health, all designed to enhance your cybersecurity and help defend against malware-related attacks. If you’re interested in exploring these features and gaining a comprehensive understanding of our platform, we invite you to visit our website.

Stay safe!

 

Methodology

NordPass, in partnership with third-party researchers, analyzed various sets of credentials sourced from a 6.6TB database. The study involved examining the source website and the type of malware used to steal the data (such as Redline, Vidar, Taurus, Raccoon, Azorult, and Cryptbot). No personal data was acquired or purchased by NordPass to conduct this study.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

How secure are your company’s social media, really?

Contents:

Social media — the missing piece in a cybersecurity puzzle

When asked about why cybercriminals target passwords, most people typically think of common motives like stealing sensitive data, hijacking accounts for ransom, or infecting systems with malware to disrupt operations. But in an exclusive interview for NordPass, Dennis-Kenji Kipker, a Professor of IT Security Law and Research Director at cyberintelligence.institute, brought to light a sometimes overlooked aspect — that some attackers may steal credentials just to get access to a company’s social media platforms and wreak havoc. He said:

 

As an attacker, I could also try to attack the whole social media system of a company and have the company’s communications under control. […] Data, if disclosed, could cause very considerable damage not only to the company as an abstract legal entity, but also to all people involved in business relationships with that company and, of course, the employees.

Dennis-Kenji Kipker

Professor of IT Security Law and Research Director at cyberintelligence.institute

Simply put, Professor Kipker points out that mishandling passwords for social media accounts can lead to more than just losing access. It can also result in losing the trust of partners and customers, which can then lead to financial losses. How do we know things like these could happen? Because similar incidents have occurred in the past.

Real-life examples of huge social media takeovers

A major corporation stuns everyone by announcing its acquisition by a primary rival; a government agency spreads fake news causing chaos in the cryptocurrency market; a renowned music label reports the passing of one of its top artists — these are not plot ideas for the next season of Black Mirror. They are real instances where false information was shared through the official social media channels of popular organizations, leading many people to believe it was true.

That’s right. The first situation refers to the 2013 Twitter hack of Burger King, where cybercriminals seized control of the company’s Twitter account to spread false news alleging that Burger King had been acquired by McDonald’s. The second incident occurred in 2024 and involved the Twitter hack of the Securities and Exchange Commission (SEC). In this case, cyber attackers exploited the SEC’s account to falsely announce the approval of spot-Bitcoin exchange-traded funds, leading to a significant surge in Bitcoin’s price. The third example pertains to the 2016 incident involving the hacking of Sony Music’s Twitter account, during which cyber attackers circulated a hoax about the death of the pop star Britney Spears.

While not officially confirmed, it’s widely suspected that these social media takeovers stemmed from compromised passwords or actions leading to password breaches, such as phishing or malware. As expected, each incident damaged the affected company’s reputation, occasionally resulting in significant consequences and, at other times, causing less severe repercussions.

Of course, as you can imagine, these are but three out of hundreds, if not thousands, of other similar cases. This begs the question: why did these events occur in the first place? 

Why do social media takeovers happen?

The first reason, as hinted earlier in this article, is that businesses often overlook the security of their social media accounts. While they focus on protecting their internal systems from malware and other threats, they sometimes neglect the security of their social media presence.

Another factor may be businesses’ tendency to prioritize their core operations over social media security, assuming these platforms are inherently safe and require no additional steps to safeguard against potential risks.

The next critical aspect is when organizations overlook the necessity of removing access to social media accounts when employees leave their positions. This creates a dual risk: first, if ex-employees are dissatisfied, they can post damaging content, harming the company’s reputation. Second, inactive accounts can become targets for hackers, allowing them to use them as gateways to take over the company’s social media channels.

Then, there’s the issue with passwords. At NordPass, we use the phrase, “For almost every task at work, there’s a password.” This rings true as most business operations necessitate the use of password-protected accounts. However, as highlighted in our Top 200 Most Common Passwords report, many individuals — regardless of their job title or position within the company — use weak passwords that can be easily cracked. Moreover, many employees use the same password across multiple accounts and services, amplifying the risk of a breach.

We also need to touch upon the irresponsible sharing of passwords among company members, often done through chat, email, or… written notes (yikes!). If some business leaders were to inquire about how their staff members share passwords for company social media accounts like LinkedIn, Instagram, or Facebook, they might be alarmed by the lack of security practices in place.

Of course, losing access to company social media accounts can also happen due to phishing, malware attacks, or other cyber intrusions targeting unsuspecting employees. However, ensuring passwords are strong and securely managed at all times decreases the chances of falling victim to such cyber threats, thus protecting the integrity and security of company social media accounts.

What if your company’s social media gets hacked?

Although it’s not overly challenging to imagine the outcomes of a social media takeover, being informed about the potential consequences can provide stronger motivation for us all to take action. 

First and foremost, a social media takeover can lead to severe reputational damage. Malicious actors have the power to tarnish an organization’s reputation by posting damaging content or spreading false rumors. This could result in the loss of key business partners and clients. Even when it’s clear that the content in question is the work of cybercriminals, rebuilding relationships with partners and customers can be more challenging than expected.

Another major risk, closely tied to reputational harm, is financial loss. When cybercriminals hijack a company’s social media channels and spread false information, it can cause existing customers to turn away and deter potential customers from engaging with the brand. As a result, the company may experience a significant decline in sales revenue, and face heightened difficulty in securing investments or loans. Not to mention the fact that the time and resources required to address the aftermath of a social media takeover can impede the company’s focus on growth.

A hostile social media takeover can also result in a loss of privacy for the company’s members. In other words, it opens the door to personal information being exposed or misused, potentially resulting in identity theft or attempts to exploit someone’s private image. Repairing such damage could require years of effort and resources beyond what the company initially anticipated.

Yes, social media takeovers can be prevented

Let’s shift our focus away from discussing the reasons and dangers of social media takeover and concentrate on solutions to the problem at hand — of which there are a couple.

To effectively prevent social media takeovers, a company must first recognize the threat. As highlighted earlier, many individuals may not even realize that cybercriminals target passwords to seize control of business social media channels. Therefore, the first step is to raise awareness across the organization and establish clear guidelines for accessing and sharing social media platform credentials among company members. This includes determining who can access the credentials, specifying who they can be shared with, and deciding what actions to take when a social media manager or anyone with access to company social media leaves the organization.

Step two involves utilizing today’s available technology to allow employees to securely handle the company’s social media account credentials. This can be achieved by adopting a robust password manager like NordPass. How so?

How NordPass can help your company in this regard

First, NordPass is an easy-to-use yet technologically advanced password manager that allows organization members to securely store, manage, and share passwords, passkeys, credit card details, and other sensitive information.

Beyond that, NordPass is a cybersecurity tool that allows you to monitor access to your company resources, including social media channels. Plus, it enables you to quickly identify weak, old, and re-used passwords in your company, and check whether company credentials have been compromised in a breach. 

As a result, NordPass can be a valuable tool for organizations looking to protect their social media accounts from misuse by outsiders  — all while enhancing performance and efficiency.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

How encryption evolved to protect us from ISPs

Why ISPs monitor our traffic

ISPs are usually large telecommunications companies that manage the networks – digital subscriber line (DSL), cable, fiber optic, satellite, etc. – that facilitate ‘the information superhighway’ of internet traffic. ISPs also distribute modems and routers (usually an all-in-one box) that enable us to use the internet on multiple devices at home or elsewhere. It is through this infrastructure that ISP monitoring takes place.

It’s important to note that there are a few legitimate reasons as to why an ISP might monitor our traffic. Here are a few examples:

  • Service quality – ISPs allocate bandwidth to optimize service based on use. For example, streaming and online gaming require high speed, uninterrupted connections, so they’re given a higher priority. Simpler web activities like browsing or sending emails, which aren’t as sensitive to minor hiccups or delays, are given a lower priority.

  • Security – ISPs monitor traffic for signs of malicious activities like malware distribution, phishing attacks, and DDoS (Distributed Denial of Service) attacks. They do this primarily to keep their user base secure and intact, but can also market security upgrades and products.

  • Customer support – With a clear overview of user home networks, devices, and traffic patterns, ISP customer support can solve issues faster – and cheaper. They can often remotely access ISP-provided routers as well.

  • Regulation – ISPs can be legally obliged to pass user data to law enforcement in certain cases and are required to monitor traffic for illegal activity.

  • Targeted advertising – You stream movies? Oh, you need a 4K TV! ISPs build user profiles based on web activity, then upsell products to you or pass your profile to data brokers for targeted advertising.

There are cases when ISPs sell your data. A 2021 Federal Trade Commission report found that, in the US: “Even though several ISPs promise not to sell consumer personal data, they allow it to be used, transferred, and monetized by others, and hide disclosures about such practices in the fine print of their privacy policies.”

How ISPs monetize our data. Source: Federal Trade Commission

How ISPs monetize our data. Source: FTC

What stops ISPs from collecting your data?

1. Regulatory requirements

  • The EU’s GDPR tightly controls how ISPs collect, store, and process personal data, which generally ensures a higher level of privacy for users.

  • The US is lacking in this area, with no broad federal legislation in place, resulting in a state-by-state patchwork of privacy laws.

  • Australia, Brazil, Canada, the EFTA countries, Japan, South Korea, and Switzerland have all enacted data protection regulations.

2. Encryption

In the old days (the wild ‘90s), there was none – ISPs could see everything. Except for some e-commerce and banking services, encryption was almost non-existent. Then in 1995, Taher Elgamal of Netscape developed Secure Sockets Layer (SSL) to secure transactions. This innovation started us down the long and winding road of encryption protocols and their eventual wide scale adoption.

A brief history of SSL to TLS

Secure Sockets Layer (SSL) was developed by Netscape, the pioneering web browser developer, as a protocol to secure transactions. SSL 2.0 was the first version released to the public in 1995. SSL 3.0, which fixed many of the vulnerabilities found in SSL 2.0, came in 1996. The groundwork was laid for future internet security protocols.

Transport Layer Security (TLS) was introduced in 1999 as TLS 1.0 by the Internet Engineering Task Force. Since then, TLS has been the internet’s security standard, undergoing multiple updates and improvements. TLS 1.2, released in 2008, added support for stronger encryption algorithms and was widely adopted for its enhanced security features.

TLS 1.3 arrived in 2018. With a simplified “handshake” process, fewer interactions were needed between client and server to authenticate one another and establish a secure connection. Boasting faster and more robust cryptographic algorithms, TLS 1.3 was a big step forward in speed, security, and privacy.

As of February 2024, 99.9% of the 150,000 most popular websites support TLS 1.2. 67.8% support TLS 1.3, and that number is growing every day.

Timeline of SSL to current day.

SNI: Scaling up the internet

Server Name Indication (SNI), an extension to TLS introduced in 2003, massively scaled up the internet’s hosting capacity. By specifying the target hostname during the “Client Hello” message (the first step in the TLS handshake), multiple HTTPS websites or services could now share a single IP address. With IPv4 addresses running out at the time (total exhaustion occurred in 2011), this was essential to keeping the internet up and running.

SNI was integrated with the QUIC protocol in 2021, boosting performance and security further. But a problem remained. SNI is unencrypted and exposes the hostname (website) that the client is trying to connect to. This issue was highlighted when certain governments including South Korea’s began using SNI filtering as a more precise means of censorship and surveillance. SNI’s purpose had been abused by ISPs and governments to collect data.

ESNI, ECH: Final piece of the security puzzle – or not?

So along came Encrypted Server Name Indication (ESNI). Introduced in 2018, it aimed to do exactly what it says on the tin: encrypting SNI. But it would only serve as a stopgap. Cloudflare, the web services company who helped develop the standard, said: “While ESNI took a significant step forward, it falls short of our goal of achieving full handshake encryption. Apart from being incomplete — it only protects SNI — it is vulnerable to a handful of sophisticated attacks.”

Most recently in line was Encrypted Client Hello (ECH) with the more ambitious goal of encrypting the entire Client Hello message. Cloudflare rolled out ECH as a TLS 1.3-exclusive extension in September 2023, but disabled it the following month to address “a number of issues”. A re-release is planned for 2024.

However, even with ECH in place, privacy concerns won’t fully go away. ECH doesn’t fully circumvent traffic analysis or ‘sniffing’ techniques that can reveal metadata like connection times, duration, packet sizes, and more – enough to start a basic user profile for tracking. And users’ IP addresses are still always exposed when online. The Internet Protocol routes online traffic, and the client-server model for data transmission wouldn’t work without visible IP addresses.

DNS: Falling short in privacy

Closely related to the IP routing system is the Domain Name System (DNS), known as ‘the internet’s phone book.’ DNS maps domain names to IP addresses. When you type a domain name like www.example.com into your browser search bar, the browser has to find out the domain’s corresponding IP address in order to request the domain’s content for you. To do this, your computer first sends a request to a DNS server, which returns the domain’s IP address (e.g. 142.250.105.100). Without this system, your browser wouldn’t know where to go.

The problem is, ISPs often run their own DNS servers to take a peek as these requests are filled. ISP-provided routers come preconfigured to direct your DNS queries to their proprietary servers. And if ISPs control a DNS server, they can effectively block the use of Encrypted Client Hello by not including ECH configurations in the HTTPS resource records returned to clients.

Protocols like DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT), which encrypt DNS requests, offer solutions to this issue. Not to be outdone, ISPs started operating their own DoH services, controlling DNS settings, and limiting configuration changes. Some providers even argued that DoH is not in the consumer’s interest. Remember: if the ISP runs the DoH service, they can see your online activities.

Even without using DNS or connecting to the wider internet, ISP-managed routers can collect information about the devices connected to them. They can track the unique Media Access Control (MAC) of each device. MAC allows devices to communicate on a local network segment, with the data being openly visible to anyone on the same network. ISPs use software on their routers to capture, fingerprint, and identify devices and their MAC addresses.

What can we do while we wait for ‘total’ encryption?

There are a few things you can take care of.

1. Be aware if you use an ISP managed router

Did it arrive at your door, perhaps with a technician ready to install it, after you signed up? Then it’s managed by the ISP, or at least set to their favored default configurations. Log in to the router, change the default password, and make sure you’re using at least WPA2 encryption. Keep in mind that if you’re using wifi calling (WhatsApp, Facetime, etc), your speech travels through these devices – another reason to fortify your network security.

2. Use a trustworthy DNS server

Look for public, privacy-focused public DNS servers. For example, Cloudflare DNS (1.1.1.1) doesn’t log DNS traffic, doesn’t save your IP address, and doesn’t sell user data to advertisers.

3. Use a VPN

Virtual private networks (VPNs) can protect your online activity by encrypting traffic going from your device to a VPN server. This server then handles your internet requests, shielding them from ISP surveillance. This protection extends to DNS queries if you use the VPN’s DNS server. Of course, using a VPN transfers your trust from the ISP to the VPN provider. That’s why no logs VPNs are among the best ways for keeping yourself safe and secure online today.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Web3 security: risks and best practices for staying safe

Web3 stands out as a new wave of innovation, offering a future where users have more control over their data and online interactions. However, this potential also brings new challenges, especially in security. Let’s carefully look into the security risks of Web3, giving you the information you need to move forward in this exciting yet risky area safely. 

Key takeaways

  • Web3 marks the start of a decentralized internet, focusing on better privacy, security, and control over data for users.

  • Companies like IBM, Walmart, and Visa are embracing Web3. They’re navigating through complex tech and changes in how things are done but find value in the stronger security and smoother operations it offers.

  • The security setup of Web3 relies on spreading out data, using secure codes, and self-executing contracts to protect against common online threats.

  • Despite its advantages, Web3 isn’t free from security challenges such as issues in contract code or scams aiming to steal information.

  • Moving to Web3 in a way that works well means putting together a solid plan for staying safe, keeping up with new information, and using the right tech.

What is Web3?

Web3 represents the internet’s new era, embracing decentralization and blockchain technology. This approach contrasts with Web2’s centralized model, where big tech firms hold the reins. This shift aims to give people back control over their data, prioritizing their privacy and security, which were major concerns in the previous internet phase.

Thanks to a growing interest in cryptocurrencies, decentralized apps, and smart contracts, Web3 is expanding quickly. Its core values include transparency, the empowerment of users, and a secure, unchangeable record of transactions. The goal is to build an internet that values fairness and centers around its users.

The transformative impact of Web3 on businesses

Web3 offers businesses enhanced security by distributing data across decentralized networks. Many companies, big and small, are exploring it. IBM, a technology giant, uses blockchain to streamline operations and increase data integrity. Walmart, a retail powerhouse, employs blockchain technology to build supply chain transparency and consumer trust. Visa, a global payments leader, settles transactions in cryptocurrency, exploring decentralized finance’s potential. Nike, a sportswear innovator, ventured into digital assets by acquiring a digital sneakers studio and tapped into new markets. Starbucks, a coffeehouse chain, introduces a blockchain loyalty program offering customers transparency in their coffee journey. Maersk, the world’s largest shipping company, improves global trade efficiency with its blockchain solution, TradeLens.

Despite these benefits, businesses face challenges like technological complexity and regulatory uncertainty. Adapting to Web3 requires shifts in corporate culture toward decentralization.

Web3’s cybersecurity backbone

Web3 cybersecurity includes features that make the digital world safer and more trustworthy. Let’s go through them one by one, explaining what each is and how it boosts security.

Web3 cybersecurity features

  1. Decentralization spreads data across many nodes, which reduces the risk of big data breaches and eliminates single points of failure. This setup makes it harder for attackers to compromise the entire system.

  2. Cryptography involves complex algorithms to secure data and transactions. It ensures that information is only accessible to those who are supposed to see it, keeping data confidential and integral.

  3. Immutable ledger is a record that no one can change once something is added. This transparency prevents tampering and builds trust among users, as everyone can see the transaction history.

  4. Smart contracts automatically execute transactions when conditions are met. This reduces the chance of errors and fraud since no human intervention is needed once the contract is set.

  5. Identity and access management (IAM) controls who gets access to what information. It verifies the identity of users and restricts access to sensitive data, ensuring that only authorized persons can see it.

  6. The Zero Trust model follows the principle of never trusting anyone by default, even if they are inside the system. It always requires verification, which minimizes unauthorized access.

  7. Tokenization turns rights to an asset into a digital token. This secures ownership and exchange of assets by encrypting the details and storing them on the blockchain.

  8. Privacy-enhancing technologies let people complete transactions without exposing personal information. Techniques like zk-SNARKs allow for transaction privacy, providing security without sacrificing confidentiality.

  9. Two-factor authentication (2FA) adds an extra layer of security by requiring a second verification, reducing the risk of unauthorized access.

  10. Permissioned blockchain allows organizations to manage who can join their network. This control over access makes private transactions more secure.

Together, these features build a safer Web3 environment, where data is protected and trust is a cornerstone.

Cybersecurity risks of Web3

Despite its robust security framework, Web3 is not immune to cybersecurity risks. Understanding them is the first step toward mitigating potential security issues.

Smart contract vulnerabilities

Sometimes, smart contracts on blockchain networks have flaws. These issues can allow unauthorized access or cause financial losses. Conducting audits on these contracts is a key part of keeping Web3 safe, as it helps find and fix these issues early.

Phishing attacks

Phishing attacks trick users into giving away sensitive information. They often target crypto wallet users with fake emails or websites. Teaching people about these dangers and using two-factor authentication can really help lower the chances of these attacks succeeding.

Front-running

Front-running is when someone acts on information about upcoming transactions in decentralized finance (DeFi) to their benefit. This practice can make decentralized apps less fair and secure.

Sybil attacks

A Sybil attack occurs when someone creates many fake identities to disrupt a decentralized network. This can undermine how decentralized apps work. Using strong identity and access management solutions is necessary to prevent such problems.

51% attacks

If a group gets control of most of a blockchain’s computing power, they can manipulate the network. Ensuring the mining power is spread out and making the blockchain technology more secure are good ways to stop these attacks.

DeFi exploits

DeFi platforms can have security weaknesses that might be exploited, leading to big losses. Doing regular checks on these platforms and their smart contracts helps find and address security gaps.

Rug pulls

Rug pulls occur when crypto project developers suddenly take all the invested money, leaving investors with nothing. Having clear transparency and community involvement can help avoid these scams in decentralized projects.

Privacy issues

Blockchain technology does make transactions more private and secure. But, there’s still a chance that transactions could accidentally reveal someone’s identity.

Network congestion

When blockchain networks get too busy, it slows down transactions and can raise costs. Developing scalable solutions and designing efficient networks are important to keep Web3 working smoothly and securely.

Regulatory compliance risks

As laws around Web3 keep evolving, staying on top of these changes is crucial for projects, especially those in DeFi and cryptocurrencies. Being aware of and following these laws helps Web3 projects avoid legal issues and succeed in the long run.

Best practices for staying safe in Web3

Adopting a proactive approach to security is essential in navigating the Web3 landscape safely. Here are key best practices to consider.

Web3 security best practices

Conduct regular security audits

Regular security audits, including smart contract audits, are crucial for spotting and fixing security vulnerabilities in smart contracts and decentralized applications (dApps).

During these audits, security experts examine the code to confirm its safety and correct operation. This kind of review is vital because it helps prevent potential exploits and attacks that could compromise the system.

Smart contract audits are a specialized part of these examinations, focusing on the integrity and security of the contracts that automate operations and transactions on the blockchain.

Implement two-factor authentication (2FA)

2FA adds an extra layer of security beyond just a password, requiring users to provide a second piece of evidence of their identity. It’s crucial for protecting accounts, especially for crypto wallets and exchange platforms. Major crypto exchanges advocate for using 2FA.

Use a hardware wallet for crypto assets

Storing crypto assets in a hardware wallet is one of the safest methods, as it keeps the assets offline and out of reach from online threat actors. Hardware wallets have proven effective against many Web3 security threats. They are particularly suitable for individuals and companies holding significant crypto assets.

Educate yourself and your team

Education on Web3 security is fundamental. Understanding the landscape of security threats can empower individuals and organizations to make informed decisions and adopt safe practices.

This includes learning about phishing scams, the importance of private key management, and the latest security threats. Companies like the Ethereum Foundation often host workshops and provide resources, underscoring the importance of continuous education in mitigating security risks in Web3.

Leverage decentralized identity solutions

Decentralized identity solutions offer a secure and privacy-preserving way of managing identities online. By allowing users to control their identity without relying on central authorities, these solutions reduce the risk of identity theft and fraud. Microsoft’s ION, a decentralized identity network built on the Bitcoin blockchain, showcases how such technology can be implemented.

Keep software and wallets updated

Regular software and wallet updates ensure that you have the latest security enhancements and bug fixes. Developers constantly update their applications to address new threats and security vulnerabilities. Neglecting updates can leave you exposed to security risks that have already been fixed in newer versions. This practice is crucial for all users and companies in the Web3 space to maintain high levels of security.

Practice safe transaction habits

Safe transaction habits include double-checking addresses before sending crypto, using trusted platforms, and verifying smart contract actions. These habits can prevent common mistakes that lead to losses.

While this practice is fundamental for everyone in the Web3 ecosystem, it is especially critical for businesses engaging in frequent and large-scale transactions.

Monitor smart contract and wallet activities

Monitoring tools can provide real-time alerts on suspicious activities, helping users and developers react quickly to potential security threats. This proactive approach can prevent significant losses by detecting unauthorized transactions or changes in smart contract behavior.

Platforms like Etherscan offer services that enable both individuals and companies to keep an eye on their assets and smart contracts, enhancing overall Web3 security.

Use secure communication channels

Secure communication channels are vital for discussing sensitive information, such as transaction details or private keys. Encrypted messaging apps or secure email services can protect against eavesdropping and phishing attacks. This practice is particularly important for organizations that handle large amounts of sensitive data, ensuring that internal communications are not vulnerable to security risks.

Implement a robust access control system

A robust access control system ensures that only authorized personnel access critical systems and information. This can include using multi-signature wallets for company funds and Identity and Access Management (IAM) solutions for controlling access to sensitive data. Such measures are crucial for organizations to protect against insider threats and unauthorized access.

Plan for incident response

Having an incident response plan in place is critical for quickly addressing security breaches. This plan should include steps for isolating affected systems, communicating with stakeholders, and conducting a post-mortem analysis to prevent future incidents. Additionally, some companies offer services that help track stolen funds.

Participate in bug bounty programs

Bug bounty programs encourage the discovery and reporting of vulnerabilities in software and systems. Participating in or hosting such programs can uncover and resolve security issues before malicious actors can exploit them. Several platforms host bug bounty programs for various Web3 security projects.

Diversify asset holdings

Diversifying asset holdings can mitigate the risk of major losses due to attacks or downturns in specific cryptocurrencies or platforms. By spreading investments across different assets and storage solutions, individuals and companies reduce their exposure to any single point of failure.

This strategy is particularly relevant in the volatile Web3 market, where the value and security stability of assets can dramatically change. Real-world examples include investment firms and crypto funds that allocate their portfolios across various blockchain networks, crypto assets, and DeFi platforms to safeguard against unforeseen security threats.

Conclusion

Web3 technology, with its decentralized networks, smart contracts, and tools that enhance privacy, plays a key role in making the digital world safer and more trustworthy. Decentralization spreads data across several places, which makes it more resilient against attacks and breaches. Cryptography keeps transactions and data safe, while records that no one can change boost transparency and trust. All these parts work together to create a strong foundation for Web3 cybersecurity, offering new ways to secure digital interactions.

Yet, diving into Web3 comes with its own set of challenges. Issues like security vulnerabilities in smart contracts, phishing attacks, and other security threats are real concerns that need careful attention.

When considering moving to Web3, it’s wise to take a careful but positive stance. The opportunity Web3 offers to change how businesses operate and interact with customers is immense. However, stepping into this new territory should be done with a solid plan for security.

It’s important to carry out regular security audits, which include checking smart contracts thoroughly to spot and fix any weak spots. Using two-factor authentication, teaching teams about the security risks they might face, and using advanced security measures like IAM and Zero Trust solutions are all effective ways to reduce these risks. To ensure your business is secure as you navigate Web3, NordLayer offers the tools and support you might need. Our sales team is here for you; don’t hesitate to reach out.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

Empowering women in tech: success stories

 
The tech industry faces a talent shortage, with an estimated 85 million unfilled positions by 2030. One contributing factor is the underrepresentation of women, who currently comprise only 22% of Europe’s tech workforce and 34.4% of the largest US tech companies. However, at Nord Security, we’re happy to be above the industry standard, with nearly 40% of our colleagues being women. Meet four exceptional women in our community – Toma Jonuškaitė, Rima Miselytė, Gintarė Kučiauskienė, and Sigita Jurkynaitė – who are making significant contributions to the industry and shaping our cyber future.

The myth-busting truth about women in tech

Tech – not just for men

In the 1840s, Ada Lovelace, a mathematician and writer, drafted the first computer algorithm, unknowingly paving the way for the future of technology. Recognized as the world’s first computer programmer, she shattered stereotypes and demonstrated that women can excel in tech alongside men.

Despite their proven capability in tech, not all see themselves fitting into this male-dominated industry.

“Our NordSwitch program is a prime example,” she says. “Out of 600 applicants, we selected 21. Surprisingly, even 13 of them were women making bold career switches. One shifted from being a professional harpist to an Engineer, and another transitioned from teaching English in South Korea and Lithuania to becoming a Junior Data Engineer.”

Despite the big underrepresentation of women still in the tech industry, a wave of change is happening. Deloitte’s findings reveal that from 2019 to 2022, women’s participation in tech saw an 11.7% surge in technical roles. The rise in women in leadership roles is even more encouraging, soaring by nearly 20%. This trend signals a brighter and more inclusive future for tech, inspiring more women to join and thrive in this dynamic field.

Tech is not (all) rocket science

Tech jobs, including cybersecurity, are challenging due to the rapidly evolving nature of the industry and the complexity of the systems involved. However, the difficulty varies depending on personal aptitude and interests.

Gintarė Kučiauskienė, a champion for diversity at Nord Security, holds the role of Product Owner at our flagship service, NordVPN. Though her position is technical, Gintarė explains that with foundational tech knowledge, strong analytical thinking, problem-solving, time management, and communication skills, the Product Owner role is well-suited to women who want to thrive in tech.

As a Product Owner, her responsibilities involve overseeing team deliverables and ensuring the product’s quality, monitoring user engagement and satisfaction, and compliance with legal standards. Additionally, she inspects the product for vulnerabilities or security flaws.

Summarizing her experience, Gintarė emphasizes her role’s complexity and demands: “The PO role indeed requires juggling many tasks simultaneously, but with a bit of knowledge in the field, it’s manageable. Although we develop techy stuff at Nord Security, it’s not NASA, and we’re not building a rocket. If I can thrive here, any woman can,” she encourages.

Rima Miselytė, Solutions Architect at NordPass and NordLocker, also supports the statement, saying that it’s just a stereotype that tech is complex and advanced.

As a Solutions Architect, she assists engineering teams in discussing, analyzing, and building more scalable and robust solutions for NordPass and NordLocker products. She plays a key role in driving the products’ major initiatives, empowering teams to develop their solutions by providing guidelines and reference architecture.

“The role requires understanding both technical capabilities and business needs and concerns to provide the technical guidelines. You need to be flexible, adaptive, and truly creative here. It’s an excellent role for engaging and communicating with everyone across the organization to design and build solutions as a team. All these aspects are what I enjoy the most about my role,” shares Rima Miselytė.

These are just a few examples of the roles in which women can truly excel in tech. Discover more opportunities at Nord Security.

Tech for non-techies

The truth is that you don’t necessarily need to be technical to work in tech. Apparently, 43% of roles advertised by tech companies were non-technical, found a study from Glassdoor.

Gintarė Kučiauskienė, Product Owner at NordVPN, expands on this idea:

Toma Jonuškaitė is one such example, holding an Employer Brand Manager role at Nord Security. She’s one of the key people shaping and promoting the company’s image as a desirable place to work. Despite not having a technical background, her career path has always been intertwined with it:

“I started my career as a business journalist, focusing on tech and automotive sectors (e.g., doing new car test drives). Later on, I switched to communications, public relations, and marketing. My experiences spanned from managing events in the gaming industry, including international conferences like Gamescom and GDC, to launching innovative products across the Baltics tobacco industry.”

There are way more roles for women looking to make their mark in the tech industry without needing deep tech knowledge, from sales, legal, and administration to design, marketing, risk, and more.

In addition, numerous strategic roles demand not just a grasp of technology but also a strong set of interpersonal skills. Our Information Security Manager, Sigita Jurkynaitė, underscores the importance of communication and teamwork.

“I work closely with diverse teams to maintain the highest international security standards. This role heavily involves maintaining info security documentation and refining processes. While these tasks may appear mundane, they are crucial for ensuring that what’s on paper works well in reality. This involves effective communication with colleagues across various departments, from HR and software development to communications and IT administration, ensuring our strategies are successfully implemented. This role gives me a unique chance to deeply understand our company and drive meaningful improvements in our security posture.”

Sigita also highlights that her position allows room for creativity, particularly in designing security awareness and training initiatives. “I love that I can let my imagination run wild, developing engaging and original content that strengthens our security culture.”

In essence, the tech industry offers a place for everyone, man and woman, with technical backgrounds or without, to innovate, create, and make a lasting impact in the industry.

Women powering the tech industry forward

The tech industry’s vast job opportunities and attractive pay packages are compelling reasons for women to explore careers in IT. Beyond these advantages, women’s involvement significantly propels the industry forward.

  1. Bridging the talent gap

     

    With cybersecurity alone reporting more than 36,000 open positions in the public sector and more than 700,000 available jobs in the private sector globally, the tech industry faces a pronounced talent shortage. “We’re facing a huge gender gap in technology, and one of the reasons why – is that the importance of inclusion is often overlooked,” emphasizes Sigita Jurkynaitė, Information Security Manager. She underscores that embracing diversity is crucial in seeking to close this gap.

    According to McKinsey research, that could become a reality. If Europe could achieve a 45% female workforce in the tech sector by 2027, it could bridge the talent shortage and potentially increase European GDP by up to €600 billion.

     

  2. Driving innovation

     

    Diverse teams are proven to be more innovative, reveals the Harvard Business Review study.

     

    Rima Miselytė, a Solutions Architect at NordPass Engineering, highlights the value of women in engineering, coding, and cybersecurity in crafting better solutions and software. Gintarė Kučiauskienė from NordVPN adds that products designed by diverse teams are more capable of addressing the varied pain points of a broad demographic, including users with special needs, underscoring the tangible benefits of diversity in creating universally accessible technology.

     

  3. Boosting performance

     

    Increased innovation creates growth in revenue and performance. Research from McKinsey found that, on average, organizations that prioritized gender diversity in their executive teams outperformed their competitors by 20% in terms of profitability.

     

  4. Enhancing talent attraction and retention

     

    Organizations fostering inclusive culture find it easier to recruit a more diverse staff. As a result, they have a 22% lower turnover rate, finds Deloitte. Additionally, women in executive roles are more likely to hire other women, enhancing the visibility of females in tech positions and inspiring their peers to pursue similar paths.

     

    Rima Miselytė, Solutions Architect at NordPass, agrees with this, saying that her colleagues in tech had a huge impact on her career:

“I’ve been lucky enough to have teammates who taught me confidence in my abilities and helped me to find my way in the tech industry (even if that forced me to get out of my comfort zone). At Nord Security, we also have plenty of successful women at all levels, from dedicated employees to great leaders, who actively lead and help grow by their determination and passion.”

How to get into tech?

Aside from those who have completed four-year degrees in IT, there are other pathways you can take when changing careers and getting into tech. To help you get there, we have listed some of the ways you can explore:

  1. Identify your desired tech role

    Dedicate time to exploring and comprehending the various roles within the tech industry. If a particular career sparks your excitement or passion, prepare to put in the effort. “Be curious, open-minded, and willing to learn from others,” advises Rima Miselytė, Solutions Architect at NordPass.

     

  2. Find out the needed skills

    Our Information Security Manager, Sigita Jurkynaitė, suggests beginning with finding the skills that are necessary for your desired role. They can be transferable (a core set of skills and abilities that go beyond a particular role) and specific, non-transferable skills unique to a domain. Typically, they’re outlined in job ads.

    For those eyeing a career in information security, Sigita outlines a skills matrix useful for the field:

    Blog woman in tech inside blog 4Gain knowledge and practice

  3.  

    As mentioned above, it’s not necessary to have a degree in IT. There are many other paths that help “new-collar workers” (skilled employees with a nontraditional education) gain skills and excel in their desired positions. You can join IT schools, but you can also participate in boot camps, online learning, open-source projects, reskilling, mentorship programs, and more.

     

    For those seeking to dive into the information security field, Sigita Jurkynaitė suggests exploring the tech career pathways, which list all the courses and certifications needed to gain the necessary knowledge.

     

    To help you gain job-ready skills, you can join internships or reskilling programs, like the one we just announced at Nord Security – NordSwitch, which is designed for people dreaming of switching careers to tech.

     

    This year, we’re seeking individuals – both women and men – keen on pivoting to roles in InfoSecurity, Data Analytics/Science, SysAdmin/SRE/DevOps, C++, GO, SWIFT, Android/Kotlin, Risk, Conversion Rate Optimization (CRO), and Sales Development (SDR).

     

    Applications are open until April 15. Selected candidates will get a 6-month paid internship contract, work together with our expert teams, and, in some cases, receive a permanent work contract.

    Apply to NordSwitch

  4. Build your network

     

    Entering the tech world is all about making the right connections. In fact, experts suggest at least 80% of all jobs, are filled through a personal and professional network.

    Attending meetups and conferences is an excellent strategy to put yourself on the map. If you’re based in Lithuania, explore our cybersecurity meetups – NordCamp.

     

  5. Start job hunting

     

    When you’re ready to find your place in tech, use every available resource to enhance your job search and increase your chances of landing a role that suits you perfectly. Follow your dream company’s websites and social media channels. Extend your search to platforms like LinkedIn, Glassdoor, and GitHub to discover open positions.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About NordLayer
NordLayer is an adaptive network access security solution for modern businesses – from the world’s most trusted cybersecurity brand, Nord Security.

The web has become a chaotic space where safety and trust have been compromised by cybercrime and data protection issues. Therefore, our team has a global mission to shape a more trusted and peaceful online future for people everywhere.

×

Hello!

Click one of our contacts below to chat on WhatsApp

Social Chat is free, download and try it now here!

×