Kuala Lumpur, April 17: Sophos has unveiled insights from its latest security analysis, the “It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024,” which underscores the escalating risks associated with remote desktop protocol (RDP).
This tool, pivotal for remote work, was manipulated in 90 per cent of cyberattacks analyzed, marking a record high since the report’s inception in 2021.
The study, drawing from over 150 incident response (IR) cases globally in 2023, pinpointed external remote services like RDP as the primary breach points in 65 per cent of situations.
This trend highlights a persistent vulnerability that organizations must address as they adapt to increasingly remote work environments.
The “It’s Oh So Quiet (?): The Sophos Active Adversary Report for 1H 2024” also notes that external remote services have consistently been the most frequent source of initial access for cybercriminals.
“External remote services are a necessary, but risky, requirement for many businesses. Attackers understand the risks these services pose and actively seek to subvert them due to the bounty that lies beyond. Exposing services without careful consideration and mitigation of their risks inevitably leads to compromise. It doesn’t take long for an attacker to find and breach an exposed RDP server, and without additional controls, neither does finding the Active Directory server that awaits on the other side,” explained John Shier, field CTO at Sophos.
In one distressing example, Sophos X-Ops reported that attackers repeatedly compromised a client through their exposed RDP ports, achieving access four times within six months.
Once inside, they moved laterally, disabled endpoint protections, and harvested credentials to maintain control and perpetuate harm.
The report further indicated a significant shift in attack methodologies, with compromised credentials overtaking vulnerabilities as the predominant initial attack vector, a first in the series’ history.
Over half of the IR cases in 2023 were due to compromised credentials, reflecting a concerning oversight as 43 per cent of affected organizations had not implemented multi-factor authentication.
Vulnerability exploitation remains a critical concern, responsible for the initial compromise in 16 per cent of 2023’s cases and 30 per cent over the four-year span of the report.
“Managing risk is an active process. Organizations that do this well experience better security situations than those that don’t in the face of continuous threats from determined attackers. An important aspect of managing security risks, beyond identifying and prioritizing them, is acting on the information. Yet, for far too long, certain risks such as open RDP continue to plague organizations, to the delight of attackers who can walk right through the front door of an organization. Securing the network by reducing exposed and vulnerable services and hardening authentication will make organizations more secure overall and better able to defeat cyberattacks,” Shier added.
The comprehensive report reflects findings from investigations across 26 sectors in 23 countries, providing a global view of the cybersecurity challenges faced today and reinforcing the critical need for robust, proactive security measures in the era of remote work.
Read the full Sophos Active Adversary Report for 1H 2024 here.
Media & PR: editor@dailystraits.com. Copyright 2021–Present DailyStraits.com. All rights reserved.