Cybersecurity company CrowdStrike announced the release of the CrowdStrike 2023 Threat Hunting Report yesterday, which covers attack trends and adversary tradecraft observed by CrowdStrike’s threat hunters and intelligence analysts.
The company’s sixth annual edition of the report revealed a massive increase in identity-based intrusions, growing expertise by adversaries targeting the cloud, a 3x spike in adversary use of legitimate remote monitoring and management (RMM) tools, and a record low in adversary breakout time.
Covering adversary activity between July 2022 and June 2023, the report is the first to be published by CrowdStrike’s newly unveiled Counter Adversary Operations team, which was officially announced this week at Black Hat USA 2023.
Key findings from the report include that within the Asia-Pacific region, technology companies were the most targeted, attracting 26% of all attacks, with telephone companies (12%), retail (11%), financial services (8%) and manufacturing (7%) making up the rest of the top five.
Chinese adversaries showed a strong interest in regional Asia-Pacific targets, targeting 14 different industry types, compared to only 6 in the Americas and 2 in Europe, the Middle East, and Africa.
The average time it takes an adversary to move laterally from initial compromise to other hosts in the victim environment fell from the previous all-time low of 84 minutes in 2022 to a record 79 minutes in 2023. Additionally, the fastest breakout time of the year was recorded at just seven minutes.
The financial industry saw an 80% YoY increase in interactive intrusions, defined as intrusions that use hands-on keyboard activity, and a 40% overall increase.
“In our tracking of over 215 adversaries in the past year, we have seen a threat landscape that has grown in complexity and depth as threat actors pivot to new tactics and platforms, such as abusing valid credentials to target vulnerabilities in the cloud and in software,” said Adam Meyers, head of Counter Adversary Operations at CrowdStrike.
“When we talk about stopping breaches, we cannot ignore the undeniable fact that adversaries are getting faster and they are employing tactics intentionally designed to evade traditional detection methods. Security leaders need to ask their teams if they have the solutions required to stop lateral movement from an adversary in just seven minutes.”