Attackers are logging in instead of breaking in

2023-04-25 10:00

In half of investigations included in the report, attackers exploited ProxyShell and Log4Shell vulnerabilities-vulnerabilities from 2021-to infiltrate organizations.

"When today's attackers aren't breaking in, they're logging in. The reality is that the threat environment has grown in volume and complexity to the point where there are no discernible gaps for defenders to exploit. For most organizations, the days of going at it alone are well behind them. It truly is everything, everywhere, all at once. However, there are tools and services available to businesses that can alleviate some of the defensive burden, allowing them to focus on their core business priorities," said John Shier, field CTO, commercial, Sophos.

More than two-thirds of the attacks that the Sophos IR team investigated involved ransomware, demonstrating that ransomware is still one of the most pervasive threats for companies.

While ransomware still dominates the threat landscape, attacker dwell time decreased in 2022, from 15 to 10 days, for all attacks dwell time types.

For ransomware cases, the dwell time decreased from 11 to 9 days, while the decrease was even greater for non-ransomware attacks.

"Organizations that have successfully implemented layered defenses with constant monitoring are seeing better outcomes in terms of attack severity. The side effect of improved defenses means that adversaries have to speed up in order to complete their attacks. Therefore, faster attacks necessitate earlier detection. The race between attackers and defenders will continue to escalate and those without proactive monitoring will suffer the greatest consequences," said Shier.

News URL

https://www.helpnetsecurity.com/2023/04/25/attacks-dwell-time/