Trend Micro 2023 annual report: 161B threats blocked, ransomware detections down 14% as attackers shift to evasion and targeted attacks
Trend Micro published its annual threat report, Calibrating Expansion, covering 2023. It reports 161 billion threats blocked, a 10% annual increase. Attackers appear to be targeting fewer, higher-value victims with more sophisticated methods. Email and web reputation blocks fell 47% and 2%, while File Reputation Service detections rose 35%, which suggests attackers are bypassing network and email filters and landing at the endpoint. Ransomware detections dropped 14% YoY, but the vendor assesses that threat actors are getting better at evading primary detection.
Technical Details
- Email malware detections rose 349% YoY, while malicious and phishing URL detections fell 27%, indicating a shift toward malicious attachments. PDFs were the top spam attachment type.
- BEC detections increased 16% YoY.
- Ransomware evasion techniques cited: LOLBINs/LOLBAs, BYOVD, zero-day exploits and AV termination. Other trends: remote encryption, intermittent encryption, EDR bypass using unmonitored VMs, and multi-ransomware attacks in which victims were hit more than once.
- Linux and macOS ransomware made up 8% of ransomware detections. Thailand and the US were the top ransomware victim countries, and banking was the most affected sector.
- Top MITRE ATT&CK detections: defense evasion, command and control, initial access, persistence and impact.
- Mimikatz and Cobalt Strike remained the preferred legitimate tools abused by criminals.
- Risky cloud app access was the top ASRM risk event, recorded almost 83 billion times.
- The Zero Day Initiative disclosed 1,914 zero-days (up 12% YoY), including 111 Adobe Acrobat and Reader bugs. Adobe was the top vendor for vulnerability reporting.
Remediation
- Apply the latest patches and upgrades to operating systems and applications.
- Monitor cloud applications closely and prioritize SOC efficiency.
- Tighten configuration settings, control application access, and strengthen account and device security.
- Detect ransomware earlier in the attack lifecycle, during initial access, lateral movement or data exfiltration.
- Use a security platform approach with continuous monitoring for new vulnerabilities.
Linha do tempo
-
Trend Micro 2023 annual report: 161B threats blocked, ransomware detections down 14% as attackers shift to evasion and targeted attacks
ler a análise desta fonte ocultar
Trend Micro published its annual threat report, Calibrating Expansion, covering 2023. It reports 161 billion threats blocked, a 10% annual increase. Attackers appear to be targeting fewer, higher-value victims with more sophisticated methods. Email and web reputation blocks fell 47% and 2%, while File Reputation Service detections rose 35%, which suggests attackers are bypassing network and email filters and landing at the endpoint. Ransomware detections dropped 14% YoY, but the vendor assesses that threat actors are getting better at evading primary detection.
Technical Details
- Email malware detections rose 349% YoY, while malicious and phishing URL detections fell 27%, indicating a shift toward malicious attachments. PDFs were the top spam attachment type.
- BEC detections increased 16% YoY.
- Ransomware evasion techniques cited: LOLBINs/LOLBAs, BYOVD, zero-day exploits and AV termination. Other trends: remote encryption, intermittent encryption, EDR bypass using unmonitored VMs, and multi-ransomware attacks in which victims were hit more than once.
- Linux and macOS ransomware made up 8% of ransomware detections. Thailand and the US were the top ransomware victim countries, and banking was the most affected sector.
- Top MITRE ATT&CK detections: defense evasion, command and control, initial access, persistence and impact.
- Mimikatz and Cobalt Strike remained the preferred legitimate tools abused by criminals.
- Risky cloud app access was the top ASRM risk event, recorded almost 83 billion times.
- The Zero Day Initiative disclosed 1,914 zero-days (up 12% YoY), including 111 Adobe Acrobat and Reader bugs. Adobe was the top vendor for vulnerability reporting.
Remediation
- Apply the latest patches and upgrades to operating systems and applications.
- Monitor cloud applications closely and prioritize SOC efficiency.
- Tighten configuration settings, control application access, and strengthen account and device security.
- Detect ransomware earlier in the attack lifecycle, during initial access, lateral movement or data exfiltration.
- Use a security platform approach with continuous monitoring for new vulnerabilities.