CERT.LV activity review Q4 2024

In Q4 2024, the number of unique IP addresses compromised in Latvia reached an all-time high, indicating a significant increase in the number and intensity of cyber threats. The number of reports logged by CERT.LV has increased by 3% compared to Q3 and by 25% compared to Q4 2023.

Latvia maintains a high level of cyber resilience despite a significant increase in the number, complexity and intensity of cyber threats. Financially and geopolitically motivated cyber attacks continue to occur in cyberspace. Cyber attackers exploit human carelessness and technological vulnerabilities through clever use of phishing, scanning, weak authentication and targeted delivery of malware.

The cyber security landscape continues to be shaped by geopolitical tensions and ideological conflicts around the world. Cyber threats in Latvia are mainly linked to pro-Russian cyber attackers. There is also an increased interest in Latvia’s ICT infrastructure from cyber attackers, possibly linked to China, indicating a new development in cyber operations by Chinese-backed cyber attackers. There is also a marginal presence of cyber attackers possibly linked to Belarus and North Korea.

Cyber attackers mostly use DDoS attacks, various vulnerabilities, insecurely exposed equipment on the Internet and sophisticated social engineering tactics to disrupt services, infect unpatched equipment, conduct cyber espionage and steal data.

Fixed cyber attacks have generally not had a significant impact on public safety and essential and critical services, indicating an effective set of protection measures. However, the types, intensity and complexity of cyber attacks are evolving rapidly. It is important to continue to work and invest in cyber resilience and defence solutions to fully protect networks and information systems. There is a need to continue to raise end-user awareness, both by providing information on the current situation, cyber threats and vulnerabilities, and by promoting good cyber hygiene practices.

The CERT.LV DNS firewall, the international hunt for cyber security threats and the growing awareness of cyber hygiene among public administration personnel provide a solid basis for stronger defences.

The strengthening of Latvia’s cyberspace continues to be facilitated by the National Cybersecurity Law (NCSL), which entered into force on 1 September 2024, expanding the range of organisations subject to the requirements of the substantially updated Directive 2022/2555 of the European Parliament and of the Council on Network and Information Systems (NIS2).

By fulfilling its mission, CERT.LV continues to promote cybersecurity and be a trusted opinion leader in Latvian cyberspace.