Posted by Mumbai: Cyber attackers used over 500 unique tools and tactics in 2022, revealed Sophos’ latest report released on Tuesday. The new Active Adversary report for business leaders shared extensive insights on the changing behaviours of cyber attackers and their attack techniques used in 2022.
Based on the data analysis of more than 150 Sophos Incident Response (IR) cases, the report claimed that cyber attackers used over 500 peculiar tools and techniques, including 118 “Living off the Land” binaries (LOLBins) last year.
Knowing that LOLBins are executable and naturally found on operating systems, attackers used and exploited them for malicious activities, making it tough for defenders to block them.
Besides, LOLBins, the report stated that unpatched vulnerabilities were the most common root cause of attackers gaining initial access to targeted systems.
In fact, in half of the investigations included in the report, attackers exploited ProxyShell and Log4Shell vulnerabilities—vulnerabilities from 2021—to infiltrate organisations. And compromised credentials were the second most common root cause of attacks, the report pointed out.
“Threat environment has grown in volume and complexity to the point where there are no discernible gaps for defenders to exploit. For most organisations, the days of going at it alone are well behind them. It truly is everything, everywhere, all at once,” said John Shier, Field CTO of Sophos.
“However, there are tools and services available to businesses that can alleviate some of the defensive burden, allowing them to focus on their core business priorities,” added Shier.
Ransomware is still one of the most pervasive threats for companies as more than two-thirds of the attacks that the Sophos IR team investigated (68%) involved ransomware, the report stated.
Ransomware also accounted for nearly three-quarters of Sophos’ IR investigations over the past three years, the company said. While ransomware still dominates the threat landscape, attacker dwell time decreased in 2022, from 15 to 10 days, for all attack types.
For ransomware cases, the dwell time decreased from 11 to 9 days, while the decrease was even greater for non-ransomware attacks. The dwell time for the latter declined from 34 days in 2021 to just 11 days in 2022. However, unlike in past years, there was no significant variation in dwell times between different-sized organisations or sectors.
“Organisations that have successfully implemented layered defenses with constant monitoring are seeing better outcomes in terms of attack severity. The side effect of improved defenses means that adversaries have to speed up in order to complete their attacks,” commented Shier.
“Therefore, faster attacks necessitate earlier detection. The race between attackers and defenders will continue to escalate and those without proactive monitoring will suffer the greatest consequences,” concluded Shier.
The Sophos Active Adversary Report for Business Leaders is based on 152 incident response (IR) investigations spanning the globe across 22 sectors.