The Most Common Root Causes of Attacks Were Unpatched Vulnerabilities and Compromised Credentials, While Ransomware Continues to Be the Most Common “End Game”

Dwell Time—Time From the Start of an Attack to When it’s Detected—Decreased From 15 to 10 Days

OXFORD, U.K. — April 25, 2023 —

Sophos, a global leader in innovating and delivering cybersecurity as a service, today released its Active Adversary Report for Business Leaders, an in-depth look at the changing behaviors and attack techniques that adversaries used in 2022. The data, analyzed from more than 150 Sophos Incident Response (IR) cases, identified more than 500 unique tools and techniques, including 118 “Living off the Land” binaries (LOLBins). Unlike malware, LOLBins are executables naturally found on operating systems, making them much more difficult for defenders to block when attackers exploit them for malicious activity.

In addition, Sophos found that unpatched vulnerabilities were the most common root cause of attackers gaining initial access to targeted systems. In fact, in half of investigations included in the report, attackers exploited ProxyShell and Log4Shell vulnerabilities—vulnerabilities from 2021—to infiltrate organizations. The second most common root cause of attacks was compromised credentials.

“When today's attackers aren't breaking in, they're logging in. The reality is that the threat environment has grown in volume and complexity to the point where there are no discernible gaps for defenders to exploit. For most organizations, the days of going at it alone are well behind them. It truly is everything, everywhere, all at once. However, there are tools and services available to businesses that can alleviate some of the defensive burden, allowing them to focus on their core business priorities,” said John Shier, field CTO, Sophos.

More than two-thirds of the attacks that the Sophos IR team investigated (68%) involved ransomware, demonstrating that ransomware is still one of the most pervasive threats for companies. Ransomware also accounted for nearly three-quarters of Sophos’ IR investigations over the past three years.

While ransomware still dominates the threat landscape, attacker dwell time decreased in 2022, from 15 to 10 days, for all attack types. For ransomware cases, the dwell time decreased from 11 to 9 days, while the decrease was even greater for non-ransomware attacks. The dwell time for the latter declined from 34 days in 2021 to just 11 days in 2022. However, unlike in past years, there was no significant variation in dwell times between different sized organizations or sectors.

“Organizations that have successfully implemented layered defenses with constant monitoring are seeing better outcomes in terms of attack severity. The side effect of improved defenses means that adversaries have to speed up in order to complete their attacks. Therefore, faster attacks necessitate earlier detection. The race between attackers and defenders will continue to escalate and those without proactive monitoring will suffer the greatest consequences,” said Shier.

The Sophos Active Adversary Report for Business Leaders is based on 152 incident response (IR) investigations spanning the globe across 22 sectors. Targeted organizations were located in 31 different countries, including the U.S. and Canada, the U.K., Germany, Switzerland, Italy, Austria, Finland, Belgium, Sweden, Romania, Spain, Australia, New Zealand, Singapore, Japan, Hong Kong, India, Thailand, the Philippines, Qatar, Bahrain, Saudi Arabia, the United Arab Emirates, Kenya, Somalia, Nigeria, South Africa, Mexico, Brazil, and Colombia. The most represented sectors are manufacturing (20%), followed by healthcare (12%), education (9%), and retail (8%).

The Sophos Active Adversary Report for Business Leaders provides organizations with actionable threat intelligence and insights needed to optimize security strategies and defenses.

To learn more about attacker behaviors, tools and techniques, Everything Everywhere All At Once: The 2023 Active Adversary Report for Business Leaders on Sophos.com.

Über Sophos

Sophos ist ein weltweit führender Anbieter von modernsten Sicherheitslösungen zur Abwehr von Cyberangriffen, einschließlich Managed Detection and Response (MDR) und Incident Response Services sowie einem breiten Portfolio an Endpoint-, Netzwerk-, E-Mail- und Cloud-Security-Technologien. Als einer der größten ausschließlich auf Cybersicherheit spezialisierten Anbieter schützt Sophos weltweit mehr als 600.000 Unternehmen und Organisationen und mehr als 100 Mio. Benutzer vor aktiven Angreifern, Ransomware, Phishing, Malware und mehr. Die Services und Produkte von Sophos sind über die Management-Konsole Sophos Central miteinander verbunden und werden vom bereichsübergreifenden Threat-Intelligence-Expertenteam Sophos X-Ops unterstützt. Die Sophos X-Ops Intelligence optimiert das gesamte Sophos Adaptive Cybersecurity Ecosystem. Dieses Ökosystem umfasst einen zentralen Data Lake, der eine Vielzahl offener APIs nutzt, die Kunden, Partnern, Entwicklern und anderen Cybersecurity- und Informationstechnologie-Anbietern zur Verfügung stehen. Sophos bietet Cybersecurity-as-a-Service für Unternehmen und Organisationen an, die vollständig verwaltete Sicherheitslösungen benötigen. Kunden können ihre Cybersicherheit auch direkt mit der Sophos Security-Operations-Plattform verwalten oder einen hybriden Ansatz nutzen, bei dem sie ihre internen Teams mit Sophos-Services ergänzen, einschließlich Threat Hunting und Maßnahmen zur Beseitigung von Bedrohungen. Sophos vertreibt seine Produkte und Services über ein weltweites Netzwerk von Vertriebspartnern und Managed Service Providern (MSPs). Sophos hat seinen Hauptsitz im britischen Oxford. Weitere Informationen finden Sie unter www.sophos.de.