The latest findings from cybersecurity researchers at Unit 42 are the prime example of the old adage “the enemy never sleeps”.
Palo Alto Networks’ security arm recently published its newest Incident Response Report (opens in new tab), in which it says that threat actors start scanning the web for vulnerable endpoints (opens in new tab) roughly 15 minutes after the CVE gets publicly disclosed.
In other words, hackers are keeping close tabs on software vendor bulletin boards, and as soon one of them publicly announces finding a vulnerability, they rush to see where an exploit is possible.
Attacks within hours
Scanning in itself isn’t a threat, and knowing a vulnerability exists is one thing, while actually exploiting it is another. However, crooks still conduct these reconnaissance tasks as they can, if all else fails, sell the intel on the black market, the researchers said.
Some of them move fast, too – Unit 42 says that “within hours”, the first active exploitation attempts can usually be seen.
According to Unit 42’s report, the most abused flaws in the first half of the year are the “ProxyShell” vulnerabilities, taking up 55% of all the reported incidents for the period. ProxyShell is a term that refers to abusing CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207, in a chain.
Log4Shell, the nightmare log4j vulnerability that experts expect will linger around for a decade, was second-placed with 14% of reports, followed by SonicWall CVEs with 7%.
One of the takeaways of the report is that most of the time, cybercriminals abuse relatively old flaws, which just goes to show how important it is to patch systems, and programs, as soon as possible. Unit 42 has also said that in a third of network breaches, software vulnerabilities were used as the initial point of entry. Another third was taken up by phishing (37%) while brute-forcing, making up for 15%, rounds off the top three.
Via: BleepingComputer (opens in new tab)
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba