May 24, 2021
Cyber attacks often go undetected in organisations’ systems, usually only detected when a ransom demand is made.
This is one of the findings in Sophos’s “Active Adversary Playbook 2021”, which details attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos’ frontline threat hunters and incident responders saw in the wild in 2020. The TTP detection data also covers early 2021.
The findings show that the median attacker dwell time before detection was 11 days (264 hours), with the longest undetected intrusion lasting 15 months.
Ransomware featured in 81% of incidents and 69% of attacks involved the use of the remote desktop protocol (RDP) for lateral movement inside the network.
FBI Warns Healthcare Sector of Conti Ransomware Attacks
inforisktoday.com - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from inforisktoday.com Daily Mail and Mail on Sunday newspapers.
Хакеры начали искать серверы Exchange уже через 5 минут после сообщения о 0Day-уязвимостях
securitylab.ru - get the latest breaking news, showbiz & celebrity photos, sport news & rumours, viral videos and top stories from securitylab.ru Daily Mail and Mail on Sunday newspapers.
Attackers spend 11 days in a network before detection
The median attacker dwell time before detection is 11 days or 256 hours, according to data from Sophos. That s time in which they re free to conduct malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more.
The company has released an Active Adversary Playbook detailing attacker behaviors and the tools, techniques and procedures (TTPs) that Sophos frontline threat hunters and incident responders saw in the wild in 2020.
Other findings include that 90 percent of attacks seen involve the use of the Remote Desktop Protocol (RDP) and in 69 percent of all cases, attackers used RDP for internal lateral movement. While security measures for RDP, such a VPNs and multi-factor authentication tend to focus on protecting external access these don’t work if the attacker is already inside the network.