IBM Security X-Force Threat Intelligence Report

IBM – in its 2023 IBM Security X-Force Threat Intelligence Report — said ransomware’s share of incidents fell 4 percentage points in 2022 as defenders were more successful detecting and preventing ransomware.
IBM HQ
Attackers innovated with the report showing the average time to complete a ransomware attack dropped from 2 months down to less than 4 days.

The deployment of backdoors, which allow remote access to systems, emerged as the top action by attackers last year. About 67 percent of those backdoor cases related to ransomware attempts, where defenders were able to detect the backdoor before ransomware was deployed. Hackers sold existing backdoor access for as much as $10,000, compared to stolen credit card data, which can sell for less than $10 today.

“The shift towards detection and response has allowed defenders to disrupt adversaries earlier in the attack chain – tempering ransomware’s progression in the short term,” said Charles Henderson, Head of IBM Security X-Force.

The IBM Security X-Force Threat Intelligence Index tracks new and existing trends and attack patterns – pulling from billions of datapoints from network and endpoint devices, incident response engagements and other sources.

The most common impact from cyberattacks in 2022 was extortion, which was achieved through ransomware or business email compromise attacks. Europe was the most targeted region for this method, representing 44 percent of extortion cases observed, as threat actors sought to exploit geopolitical tensions.

Thread hijacking saw a significant rise in 2022, with attackers using compromised email accounts to reply within ongoing conversations posing as the original participant. X-Force observed the rate of monthly attempts increase by 100 percent compared to 2021 data.

The proportion of known exploits relative to vulnerabilities declined 10 percentage points from 2018 to 2022, due to the fact that the number of vulnerabilities hit another record high in 2022. The findings indicate that legacy exploits enabled older malware infections such as WannaCry and Conficker to continue to exist and spread.

Cybercriminals often target the most vulnerable industries, businesses, and regions with extortion schemes, applying high psychological pressure to force victims to pay. Manufacturing was the most extorted industry in 2022, and it was the most attacked industry for the second consecutive year.

Email thread hijacking activity surged last year, with monthly attempts by threat actors doubling compared to 2021 data. Attackers used this tactic to deliver Emotet, Qakbot, and IcedID, malicious software that often results in ransomware infections.

With phishing being the leading cause of cyberattacks last year, and thread hijacking’s sharp rise, it’s clear that attackers are exploiting the trust placed in email. Businesses should make employees aware of thread hijacking to help reduce the risk of them falling victim.

The ratio of known exploits to vulnerabilities has been declining over the last few years, down 10 percentage points since 2018. Cybercriminals already have access to more than 78,000 known exploits, making it easier to exploit older, unpatched vulnerabilities.

X-Force recently reported an 800 percent increase in WannaCry ransomware traffic within MSS telemetry data since April 2022. The continued use of older exploits highlights the need for organizations to refine and mature vulnerability management programs, including better understanding their attack surface and risk-based prioritization of patches.

The number of cybercriminals targeting credit card information in phishing kits dropped 52 percent in one year, indicating that attackers are prioritizing personally identifiable information such as names, emails, and home addresses, which can be sold for a higher price on the dark web or used to conduct further operations.

Energy held its spot as the 4th most attacked industry last year, as global forces continue to affect an already tumultuous global energy trade. North American energy organizations accounted for 46 percent of all energy attacks observed last year, a 25 percent increase from 2021 levels.

Accounting for nearly one-third of all attacks that X-Force responded to in 2022, Asia saw more cyberattacks than any other region. Manufacturing accounted for nearly half of all cases observed in Asia last year.

Related News

Latest News

Latest News