In 2023, more than 1/5 of cyberattacks persisted for over a month, the annual Kaspersky Incident Response 2023 report has revealed, with trusted relationships emerging as one of the main attack vectors in these prolonged cases. The report draws on the results of Kaspersky's cyberattack investigations throughout the year, gathered when supporting organizations seeking incident response assistance or when hosting expert events for their internal incident response teams.
Kaspersky Incident Response 2023 report indicates that long-lasting cyberattacks that persist for more than a month constituted 21.85% of the total, increasing from 2022 by 5.55%. One notable trend observed in these attacks was the exploitation of trusted relationships as a primary vector. Compromises leveraging trusted relationships have occurred previously, but in 2023 their frequency increased, accounting for 6.78% of the total number of attacks.
As this method of attack enables threat actors to infiltrate multiple victims through a single compromised organization, investigative teams face several additional challenges. Firstly, initially targeted organizations don’t always recognize the importance of thorough investigations and may be reluctant to cooperate.
Secondly, attacks initiated through trusted relationships often require more time to progress from the initial intrusion to the final incursion phase. Therefore 50% of these attacks lasted more than a month. A similar proportion of attacks exceeding one month were exclusively registered within the insider and phishing vectors.
"Cybersecurity threats are constantly evolving, and our latest findings underscore the critical role of trust in cyberattacks. In 2023 and for the first time in recent years, attacks through trusted relationships were among the three most used vectors. Half of these incidents were discovered only after a data leak had been found. By exploiting trusted relationships, threat actors can prolong attacks and infiltrate networks for extended periods, posing significant risks to organizations. It's imperative for businesses to remain vigilant and prioritize security measures to safeguard against such sophisticated tactics." comments Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky.
To mitigate the risks highlighted in the report, Kaspersky recommends:
- Foster a culture of security awareness among employees.
- Restrict public access to management ports.
- Enforce a zero-tolerance policy for patch management or implement compensatory measures for public-facing applications.
- Back up critical data to minimize damage
- Implement robust password policies and multifactor authentication.
- To enhance your company’s protection against advanced attacks and detect attacks at earlier stages, adopt managed security services such as Kaspersky Managed Detection and Response (MDR).
- In case of suspicious activities that can lead to breaches or incidents that have already occurred, seek the help of cybersecurity experts who provide services, such as Kaspersky Incident Response.
To learn more, please visit Incident Response 2023 report link.
