25,789 followers
Mandiant (now part of Google Cloud) just released our annual security report - M-Trends 2024. The report summarizes the trends we observed in our breach investigations throughout 2023. There are so many gems throughout the report. Here are a few of the observations that stood out to me: 1️⃣ Espionage actors are increasingly exploiting 0-day vulnerabilities and deploying custom malware on edge devices (firewalls, VPNs, and security appliances) and other systems like VMware hypervisors that don’t commonly support EDR solutions. ☣️ Most of these systems are closed and require significant effort to examine for evidence of compromise. They often require the vendor to acquire forensic data from it (not every vendor will do this). ☣️ Some vendors have created file integrity checking solutions to help organizations identify when devices have been compromised. ☣️ As an community, we have a *long* way to go to address this problem. We anticipate we will continue to see espionage actors targeting these systems to obtain initial and persistent access to victim environments. 2️⃣ The median attacker dwell time (the duration between the initial compromise to detection) is 10 days. 6% of the cases we worked had a dwell time between 1-5 years. 3️⃣ The dwell time for ransomware & multifaceted extortion events was 5 days, usually because the threat actor sent an extortion communication to the victim by day 5. 4️⃣ 54% of our clients learned about the incident by a third party (law enforcement, security firm, threat actor, or media). 5️⃣ Exploitation of vulnerabilities continue to be #1 way in which threat actors gain initial access to victim environments (38% of our cases). Phishing is next (17%). 6️⃣ 15% of the incidents that we responded to last year were a result of a prior security incident that wasn’t fully remediated e.g. a backdoor wasn’t found/removed or a service account’s password wasn’t rotated. 7️⃣ Stolen credentials by infostealers accounted for 10% of the intrusions. This is an issue with both corporate assets and personal computers. ☣️ Many people occasionally access their work email from their home computers. People (or their children) sometimes install pirated software on their home computers that are laced with infostealing malware. ☣️ Threat actors are increasingly leveraging stolen credentials or cookies from home computers to access corporate environments. 8️⃣ 17% of the cases we investigated had multiple threat actors in the environment. Thanks to the hundreds of Mandiant professionals that contributed to this report and analysis! Special shout out to Kirstie F., Scott Runnels, Nick Richard, Kelli V., Adam Greenberg, Maria Pavlick-Larsen, Melanie Leboeuf, Kerry Matre, Jennifer Guzzetta, Amanda C., Adrian Sanchez Hernandez, Alexander Marvi, Alyssa Glickman, Angelus Llanos, Ashley Pearson, Austin Larsen, Brandon Wilbur, Brendan McKeague, and so many more. Link to the report: https://lnkd.in/eSqtxgSJ