The Evolving Cyber Landscape: Insights from 2024 Reports

The 2024 version of the respected Verizon Data Breach Investigation Report (DBIR) came out in May. The 100-page report includes many amazing insights and trends.

The press release from Verizon included these top items:

• Vulnerability exploitation surged by nearly three times (180 percent) over last year.
• Ransomware and the meteoric rise of extortion techniques accounted for a third (32 percent) of all breaches.
• More than two-thirds (68 percent) of breaches involve a non-malicious human element.
• 30,458 security incidents and 10,626 confirmed breaches were analyzed in 2023 — a twofold increase over 2022.
• Verizon security by the numbers: 4,200-plus networks managed globally, 34 trillion raw logs processed/year, and nine security operation centers around the globe.

Also, analysis of the Cybersecurity Infrastructure and Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog revealed that on average it takes organizations 55 days to remediate 50 percent of critical vulnerabilities following the availability of patches. Meanwhile, the median time for detecting the mass exploitations of the CISA KEV on the Internet is five days.

Here were some of the summary excerpts from the full report:

• “Our ways-in analysis witnessed a substantial growth of attacks involving the exploitation of vulnerabilities as the critical path to initiate a breach when compared to previous years. It almost tripled (180% increase) from last year, which will come as no surprise to anyone who has been following the effect of MOVEit and similar zero-day vulnerabilities. These attacks were primarily leveraged by Ransomware and other Extortion-related threat actors. As one might imagine, the main vector for those initial entry points was Web applications.
• “Roughly one-third of all breaches involved Ransomware or some other Extortion technique. Pure Extortion attacks have risen over the past year and are now a component of 9% of all breaches. The shift of traditional ransomware actors toward these newer techniques resulted in a bit of a decline in Ransomware to 23%. However, when combined, given that they share threat actors, they represent a strong growth to 32% of breaches. Ransomware was a top threat across 92% of industries.
• “Our dataset saw a growth of breaches involving Errors, now at 28%, as we broadened our contributor base to include several new mandatory breach notification entities. This validates our suspicion that errors are more prevalent than media or traditional incident response-driven bias would lead us to believe.”

This video describes many of the 2024 report’s top findings:

WATCHGUARD INTERNET SECURITY REPORT

The quarterlyWatchGuard Internet Security Report is less well-known, but also provides many meaningful insights on the latest cyber threats we face.

Key findings from the data show:

• Detections of malware targeting endpoints increased by 82 percent.
• Widespread detection of a malware variant targeting enterprise Internet of Things (IoT) devices such as smart TVs, with detection of “Pandoraspear” malware targeting enterprise smart TVs.
• Emerging trends in malware targeting Chromium-based web browsers.

Additional key findings from WatchGuard’s Q1 2024 Internet Security Report include:

• The average volume of malware detections per WatchGuard Firebox plummeted by nearly half (49 percent) during the first quarter, while the amount of malware delivered over an encrypted connection swelled by 14 points in Q1 to 69 percent.
• A new variant of the Mirai malware family that targeted TP-Link Archer devices by using a newer exploit (CVE-2023-1389) to access compromised systems emerged as one of the most widespread malware campaigns of the quarter. The Mirai variant reached nearly 9 percent of all WatchGuard Fireboxes around the globe.
• This quarter, Chromium-based browsers were found to be responsible for producing more than three-quarters (78 percent) of the total volume of malware originating from attacks against web browsers or plugins, a significant rise compared to the previous quarter (25 percent).
• A vulnerability in the widely used HAProxy Linux-based load balancer application, which was first identified in 2023, was among the top network attacks of the quarter. The vulnerability shows how weaknesses in popular software can lead to a widespread security problem.

FINAL THOUGHTS

“We are reaching out to known LockBit victims and encouraging anyone who suspects they were a victim to visit our Internet Crime Complaint Center at ic3.gov,” FBI Cyber Division Assistant Director Bryan Vorndran said in a keynote address at the 2024 Boston Conference on Cyber Security.