by threatening to make them public (so-called double extortion) continued in 2020. According to information available to the NÚKIB, no Czech institution fell victim to such an attack in 2020. However, considering the global trend, there is a realistic possibility (25% – 50% probability) that the Czech Republic will be affected by this trend in the future. Although a ransomware attack can have a serious impact on the operation of an institution, the NÚKIB recommends that attacked entities do not pay for the decryption of their data. There is no guarantee that the attacker will really do what they promise. Moreover, obtaining the money is just motivation for the attacker to attack the same institution again. In order for at­ tacked organisations to avoid the need to consider this option, it is highly desirable to keep networks segmented, keep the operating system and applications updated, and create offline backups of at least the critical systems nec­ essary for the operation of the institution. The answers from the respondents indicate that 56% of them create such offline backups and have implemented testing pro­ cedures, 33% of them have offline backups but do not test their recoverability, and 7% of the respondents do not create offline backups at all. With respect to the severity and topicality of the ransomware issue, the NÚKIB issued an analysis in 2020 summarising the basic information about this type of attack, describing the fundamental vulnerabilities, and providing recommendations on how to defend against similar attacks. The analysis is available on the NÚKIB’s website: www.nukib.cz/cs/infoservis/aktuality The supporting material Recommendations for mitigation, prevention and response, on which the NÚKIB cooperated with AFCEA and NAKIT, is available on the website at www.nukib.cz/download/ publikace/podpurne_materialy RANSOMWARE, DDOS ATTACKS AND SPEAR-PHISHING: THE THREE MOST SERIOUS THREATS OF 2020 According to organisations, the most severe threats of 2020 included ransomware and DDoS attacks (Chart 17). Almost one-third of the respondents from the health­ care sector and 25% of the respondents from the financial and public sectors considered ransomware to be the most serious form of attack. The third most serious threat was spear-phishing. In the past, potential phishing attacks were relatively easy to detect thanks to the poor command of the Czech language and different domains in the e-mails. In recent years, however, there has been a trend towards higher sophistication of such attacks: they use better e-mail formats and an extensive portfolio of justifications, ranging from calls for invoice payments to the recovery of account access data. 28% of organisations from the healthcare sector identified ransomware as the most serious threat of 2020 In 2020, the NÚKIB participated in dealing with the impacts of phishing campaigns as well as more targeted spear-phishing campaigns, most often against obliged entities in the public sector and, less often, the healthcare sector. Attackers most often succeeded in persuading their victims to open a file attached to an e-mail with a notification to pay an invoice. By opening the file, the user enabled macros that then caused infec­ tion with different malware. 53% of organisations claimed that they faced spear-phishing attacks or attempts in 2020 THE RECOMMENDATIONS OF THE NÚKIB FOR DEFEND AGAINST SPEAR-PHISHING ATTACKS INCLUDES: Do not allow macros in MS Office documents. Do not automatically open attachments and links in e-mails. Check e-mail addresses in the case of urgent or unusual requirements. In the event of doubt or suspicion, contact the sender via another channel, then contact your IT department. Limit sharing information about job on social networks. For more details about spear-phishing and how to defend against it, visit the NÚKIB’s website at: www.nukib.cz/cs/infoservis/doporuceni Cyber Threats 17