What do backdoors, ransomware and catphishing, extortion and exploitation have in common?
They are some of the top trends we identified in this year's X-Force Threat Intelligence Index.
Attackers followed the money.
And right now, persistent access to corporate environments go for a lot of money on the dark web,
making backdoors a profitable commodity for attackers.
Representing 21% of cases,
backdoors, which are malware offering attackers remote access to compromised systems,
were the most common action observed in incidents in 2022,
knocking out ransomware which held the top spot since 2020.
Attackers often use backdoors or persistent access to execute ransomware attacks.
Unless more businesses put their defenses on the offense,
today's backdoor problem will turn into tomorrow's ransomware crisis.
Representing 17% of attacks worldwide, ransomware was the second most common action observed in 2022.
An X-Force study revealed that while there's been a slight decline in the prevalence of ransomware,
attacks took 94% less time over the last few years.
Thread hijacking attempts doubled compared to 2021.
Thread hijacking, another form of catphishing, is when an attacker compromises a victim's email account
and replies to a recent email thread impersonating the victim.
By hijacking an email thread,
adversaries can trick a target's friends, family, even coworkers,
into providing access to sensitive information, data or systems, creating a chain reaction with multiple victims.
Extortion is a battle tested technique that exerts pressure levers to inflict maximum pain on a victim organization.
And the latest scheme is involving customers and business partners as pawns.
Extortion was the top impact observed in 2022.
More than one quarter of attacks involved some form of extortion.
For the second year in a row, manufacturing was the most extorted industry.
Extortion accounted for 30% of incidents in manufacturing, and 27% in all industries.
Even as the number of vulnerabilities disclosed hit another record high,
the proportion of weaponized exploits to reported vulnerabilities has been trending down.
From 2018 to 2022 exploits relative to vulnerabilities dropped by more than 9%.
Attackers have access to nearly 78,000 known exploits,
making it easier to use an existing exploit left unpatched
rather than investing time and resources into developing a new one.
In 2022, X-Force observed several incidents resulting from 3 to 5 year old exploits.
So what can you do?
Use adversary simulation to understand an attacker's view of both known and unknown risks.
This can help organizations take preventative measures before an incident happens.
Take steps to protect yourself from threat hijacking, such as using strong and unique passwords
and enabling multi-factor authentication.
For organizations that have a low threshold for downtime,
they need to have a proactive cybersecurity strategy,
including active threat assessment playbooks and other cyber range activities.
And remember to operate under the assumption of an assumed breach.
Assume an attacker already has access to your environment and is moving around.
Be proactive, not reactive.
Stop focusing on the perimeter.
Start focusing on detection and response.
Prioritize your security ...
and win.