CA-FORESCOUT
In the last year, the world’s critical infrastructure – the medical, power, communications, waste, manufacturing, and transportation equipment that connects people and machines – has been under near-constant attack. Forescout Research – Vedere Labs recorded more than 420 million attacks between January and December 2023. That is 13 attacks per second, a 30% increase from 2022.
This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240123671589/en/
2023 Global Threat Roundup Highlights from Forescout Research (Graphic: Business Wire)
Forescout, a global cybersecurity leader, unveiled the global findings of recorded attacks in its Adversary Engagement Environment (AEE) in the new report, “2023 Global Threat Roundup.” The AEE is maintained by Vedere Labs, a leading global team dedicated to uncovering vulnerabilities in and threats to critical infrastructure.
Despite the formidable challenges posed by the ongoing surge in cyber-activity, there is an optimistic path forward. Elisa Costante, VP of Research at Forescout Research – Vedere Labs, highlights the potential for positive change, stating, "While it's true that current efforts have fallen short in fully harnessing crucial technology to fortify critical assets and assess risks, there is an opportunity for improvement."
Read the blog: 2023 Global Threat Roundup: Trends in Cyberattacks, Exploits and Malware
Here are the top five insights from Forescout Research:
-
Not Yet Dormant: Log4j Dampens Software Library Exploits
Exploits against software libraries are witnessing a decline due to the waning popularity of Log4j exploits. This lull has given rise to a surge in exploits targeting network infrastructure and Internet of Things (IoT) devices.
Among the IoT landscape, the spotlight falls on IP cameras, building automation systems, and network-attached storage, emerging as the most sought-after targets for malicious actors.
Only 35% of exploited vulnerabilities made an appearance in the Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) list. This divergence emphasizes the need for a proactive and comprehensive approach to cybersecurity, transcending reliance on known vulnerability databases.
-
OT Protocols Bear the Brunt
Operational Technology (OT) finds itself under relentless assault, with five key protocols bearing the brunt of persistent attacks. The primary targets include protocols used in industrial automation and power sectors, such as Modbus, subject to a staggering one-third of all attacks, closely followed by Ethernet/IP, Step7, and DNP3, each accounting for approximately 18% of the onslaught. IEC10X rounds out this list with 10% of attacks, leaving the remaining 2% distributed among various protocols, with BACnet emerging as the majority.
Building automation protocols, such as BACnet, experience less frequent scans. However, the relative scarcity of scans belies an alarming trend—targeted exploits against vulnerabilities in building automation devices are more prevalent.
-
Post-Exploitation Tactics Shift
Persistence tactics mark a 50% surge from 3% in 2022, along with discovery (roughly 25%) and execution (the other roughly 25%). While most observed commands used by threat actors remain targeted at generic Linux systems, a notable trend involves specific commands executed for network operating systems found on widely used routers.
-
Malware Families Remain Strong
Malware families persist as formidable threats. The Agent Tesla Remote Access Trojan (RAT) commands a significant 16% share of observed malicious activity. Following closely are variants of the Mirai botnet, comprising 15%, and the Redline info stealer, holding its ground at 10%.
Among command-and-control servers, Cobalt Strike emerges as the undisputed leader, commanding a substantial 46% share, trailed by Metasploit at 16%, and the emerging Sliver C2 at 13%. Most of these servers are in the United States, constituting 40% of the global landscape, with China and Russia following at 10% and 8%, respectively.
-
Threats Unleashed Across 163 Countries
Threat actors have cast a digital net far and wide, impacting 163 countries. The United States stands as the primary target, bearing the brunt with 168 malicious actors setting their sights on the nation. Other countries include the United Kingdom (88), Germany (77), India (72), and Japan (66).
The usual suspects boast high concentrations of threat actors: China (155), Russia (88), and Iran (45), collectively representing nearly half of all identified threat groups. The crosshairs of these malicious entities are predominantly fixed on three key sectors: Government, Financial Services, and Media and Entertainment. As the primary pillars of societal infrastructure, these industries are at the forefront of cyber warfare, emphasizing the need for heightened security measures and collaborative efforts.
Costante continues, “The key lies in achieving comprehensive visibility, ensuring real-time contextual awareness of every device, whether managed or unmanaged. By doing so, large enterprises can transition from a reactive defense posture to a more proactive approach, steering clear of the futile game of security whack-a-mole. This shift towards enhanced visibility and proactive defense strategies signals a brighter outlook for critical infrastructure.”
For more information, download the full report, “2023 Global Threat Roundup,” now at https://www.forescout.com/resources/research-report_2023-threat-roundup.
How Forescout Research Works
Forescout Research employs its Adversary Engagement Environment (AEE) to conduct analysis, leveraging a blend of real and simulated connected devices. This dynamic environment functions as a robust tool, enabling the pinpointing of incidents and the identification of intricate threat actor patterns at a granular level. The overarching objective is to elevate responses to complex critical infrastructure attacks by leveraging the detailed insights and understanding derived from this specialized deception environment. The AEE is maintained by Vedere Labs, a leading global team dedicated to uncovering vulnerabilities in and threats to critical infrastructure. Forescout products directly leverage this research, which is also shared openly with vendors, agencies, and other researchers.
About Forescout
Forescout Technologies, Inc., a global cybersecurity leader, continuously identifies, protects and helps ensure the compliance of all managed and unmanaged connected cyber assets – IT, IoT, IoMT and OT. For more than 20 years, Fortune 100 organizations and government agencies have trusted Forescout to provide vendor-agnostic, automated cybersecurity at scale. The Forescout® Platform delivers comprehensive capabilities for network security, risk and exposure management, and extended detection and response. With seamless context sharing and workflow orchestration via ecosystem partners, it enables customers to more effectively manage cyber risk and mitigate threats.
To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.
View source version on businesswire.com: https://www.businesswire.com/news/home/20240123671589/en/
About Business Wire
Subscribe to releases from Business Wire
Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.
Latest releases from Business Wire
AEVEX Achieves AS9100 Certification6.2.2025 16:18:00 CET | Press release
AEVEX Aerospace, a global leader in cutting-edge unmanned systems and services, is proud to announce it has been awarded the prestigious AS9100 certification for its Tampa, Florida facility. This internationally recognized standard provides the framework for developing and implementing quality management systems within the aviation, space, and defense industry. Achieved in just 9 months from official project launch, this certification further demonstrates the AEVEX commitment to delivering world-class products to the aerospace and defense markets. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20250206206147/en/ AEVEX Aerospace achieves AS9100 certification, reinforcing its commitment to quality, innovation, and excellence in aerospace and defense. (Graphic: Business Wire) AS9100, an industry-specific enhancement of ISO9001, establishes a set of robust quality management requirements to ensure the reliable delivery of safe, hi
Rimini Street Celebrates the 10th Anniversary of its Corporate Foundation with a $100,000 RMNI LOVE Charitable Grant Giveaway6.2.2025 15:00:00 CET | Press release
Company’s self-funded charitable program invites certified charities in select cities to apply for one of ten $10,000 grants Rimini Street, Inc. (Nasdaq: RMNI), a global provider of end-to-end enterprise software support and innovation solutions, the leading third-party support provider for Oracle, SAP and VMware software, today announced a $100,000 RMNI LOVE Charitable Grant Giveaway, commemorating the 10th anniversary of its self-funded philanthropic program, the Rimini Street Foundation. Registered charities in select cities across the globe, where a concentrated number of Rimini Street employees and clients are represented, are invited to apply for one of ten $10,000 grants, to be awarded throughout 2025 at various in-person gatherings. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20250206639812/en/ Rimini Street Celebrates the 10th Anniversary of its Corporate Foundation with a $100,000 RMNI LOVE Charitable Grant Giveaw
A Beloved Classic Just Got Sweeter Than Ever; Candy Crush Solitaire™ Launches Worldwide6.2.2025 14:00:00 CET | Press release
King, the interactive entertainment company behind the world-famous Candy Crush® franchise, today launches Candy Crush Solitaire™on mobile devices worldwide. Candy Crush Solitaire brings a fresh take to the classic card game, combining the timeless fun of solitaire with the vibrant and colorful world of Candy Crush. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20250206977362/en/ Candy Crush Solitaire gameplay (Graphic: King) Candy Crush Solitaire offers players a fun, mentally stimulating challenge, combining the familiar gameplay of TriPeaks solitaire with challenging levels, innovative gameplay, and tasty rewards, as they are immersed into the sensory and whimsical Candy Crush universe. Beloved characters join players on a sweet journey around the world, collecting Candified postcards and delicious rewards as they progress through the game, solving puzzles and stacking cards. This new mobile game offering will launch with
Saudi Sports for All Federation Unveils Riyadh Marathon Route, Venues, and Sponsors for Inaugural SFA International Sporting Events6.2.2025 13:41:00 CET | Press release
The Saudi Sports for All Federation (SFA) has announced key details for the inaugural 2025 SFA International Sporting Events, which include the SFA Expo and Riyadh Marathon. The SFA Expo will take place from February 5-7, 2025, at Riyadh’s JAX District, while the Riyadh Marathon is set for Saturday, February 8, 2025. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20250206409638/en/ Saudi Sports for All Federation Unveils Riyadh Marathon Route, Venues, and Sponsors for Inaugural SFA International Sporting Events (Photo: AETOSWire) The SFA Expo will serve as the marathon’s bib collection hub and will feature interactive zones focused on sports, health, and fitness, showcasing cutting-edge equipment, wellness activities, and emerging technologies. The event will also include a B2B lounge for industry networking, and workshops on mindfulness and nutrition. Another highlight will be the Primal Race on Friday, February 7, a function
Align Partners Submits Shareholder Proposals at Coway Co., Ltd. to Protect the Interests of Minority Shareholders6.2.2025 13:00:00 CET | Press release
Proposals follow Coway’s failure to respond to governance concerns surrounding how the Board manages conflicts of interest with its largest shareholder, Netmarble.Align submitted shareholder proposals to strengthen the independent oversight mechanism at Coway by nominating an independent governance and capital markets expert.To ensure minority shareholder representation is upheld, and meet market best practice, Align is also proposing Coway to introduce cumulative voting. Align Partners Capital Management Inc. ("Align Partners"), a shareholder of Coway Co., Ltd. ("Coway" or "Company") since 2023, submitted 4 shareholder proposals on February 6, 2025, for the upcoming Annual General Meeting (“AGM”). These proposals aim to ensure that Coway’s governance works for all, and not just its largest shareholder. More specifically, Align Partners will be seeking support to appoint Namuh Rhee, an independent governance and capital markets expert and Chair of the Korea Corporate Governance Forum,
In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.
Visit our pressroom