A Human at the Keyboard: CrowdStrike Reports 60% Jump in Interactive Intrusions
Feb 22, 2024
auto_awesome
Explore the surge in interactive cyber intrusions with a 60% increase, 75% malware-free attacks, and adversary tactics. Also, learn about the rise in attacks targeting cloud environments, the speed of adversaries moving through systems, and the tactics used in data leakage and ransomware extortion schemes.
Interactive intrusions have risen by 60%, signaling a shift towards human-driven cyberattacks over traditional malware tactics.
Adversaries are increasingly targeting cloud environments, exploiting security gaps and necessitating a comprehensive approach to cloud security.
Deep dives
Increasing Threat of Interactive Intrusions
The 2024 Global Threat Report reveals a 60% increase in interactive intrusions, emphasizing the shift from malware issues to targeted human-driven attacks. Threat actors engage in direct, hands-on-keyboard intrusions, significantly reducing breakout times to a mere 62 minutes, highlighting the speed and efficiency of modern adversaries. The report underscores the need for organizations to bolster cybersecurity defenses against these fast and targeted interactive intrusions.
Rising Adversaries and Cloud Intrusions
The report highlights a 75% increase in cloud intrusions, indicating the growing sophistication and awareness of threat actors in cloud environments. Adversaries leverage cloud infrastructure to hide and pivot across enterprise, cloud, and identity stacks, exploiting gaps in security visibility. Enterprises face challenges in tracking adversaries seamlessly across different domains, necessitating a holistic approach to cloud and enterprise security.
Escalating Data Theft and Ransomware Trends
Adversaries demonstrate a shift towards data theft, with a 76% increase in data postings on Dedicated Leak Sites, exposing sensitive and personally identifiable information. The rise in data extortion attempts signifies a potential financial and reputational risk for organizations. While ransom demands decrease, adversaries focus on monetizing stolen data and leveraging regulatory pressures for extortion, posing significant cybersecurity challenges.
E-Crime Index and Adversarial Trends
The E-Crime Index in the report exhibits a higher level of e-crime activity in comparison to previous years, reflecting an uptick in exploits, costs, and vulnerabilities in the underground economy. Notable increases include the cost of loaders, crypto, and data theft operations, highlighting a trend towards faster, high-volume attacks. Adversaries adapt to changing market dynamics by increasing tool costs, emphasizing the need for organizations to enhance cybersecurity measures.
The days of automated cyberattacks are dwindling: last year CrowdStrike saw a 60% jump in interactive intrusions, a type of attack in which a human is on the other side, working to break in and navigating their target environment as soon as they gain access. Most (75% of) attacks in 2023 didn’t involve malware at all — in nearly all cases, the adversary relied on identity-related techniques or exploited an unmanaged device.
The threat landscape is constantly evolving as adversaries explore new tactics. And as the CrowdStrike 2024 Global Threat Report shows, a lot can change in a year. We’re seeing more adversaries, operating at greater speed and conducting more attacks than ever.
In this episode, Adam and Cristian reflect on the early days of the Global Threat Report and examine the key findings of this year’s report. Highlights include:
62 minutes: The average time an adversary needs to move from an initial access point to another host in the target environment
232: The number of adversaries CrowdStrike tracks
75%: The year-over-year increase in attacks targeting cloud environments