Secureworks State of the Threat Report 2022
Secureworks has published its annual State of the Threat Report, revealing that the exploitation in remote services has become the primary initial access vector (IAV) in ransomware attacks over the past year, accounting for 52% of ransomware incidents analysed by Secureworks over the period (overtaking credentials-based attacks from 2021). Alongside this, there has also been a 150% rise in the use of infostealers, making them a key precursor to ransomware. Both these factors keep ransomware the primary threat for organisations, who must fight to stay abreast of the demands of new vulnerability prioritisation and patching. The 2022 State of the Threat Report from Secureworks provides an overview of how the global cybersecurity threat landscape has evolved over the last 12 months, with a focus on the Secureworks Counter Threat Unit’s (CTU) first hand observations of threat actor tooling and behaviors. Highlights from the Report include: Shift to exploiting vulnerabilities as primary initial access vector (IAV) over credentials-based attacks Accelerated use of Infostealers as a means of enabling ransomware operations Insights into the changing groups and threats associated with the continued dominance of ransomware Changes and newcomers in the loader landscape Tools and tactics of hostile government-sponsored groups across the world The onward march of ransomware Ransomware continues to remain the primary threat facing organisations accounting for more than a quarter of all attacks. Despite a series of high-profile law enforcement interventions and public leaks, and a small slow down over the summer months, ransomware operators have maintained high levels of activity. The median detection window in 2022 is four and a half days, compared to five days in 2021. The mean dwell time in 2021 was 22 days but so far in 2022 is down at 11 days. Companies effectively have one working week to respond to and mitigate damage. […]
