Global attacker median dwell time continues to fall
While the use of zero-day exploits is on the rise, Mandiant’s M-Trends 2024 report reveals a significant improvement in global cybersecurity posture: the global median dwell time – the time attackers remain undetected within a target environment – has reached its lowest point in over a decade.
The metrics reported in M-Trends 2024 are based on Mandiant Consulting investigations of targeted attack activity conducted between January 1, 2023 and December 31, 2023.
Global cybersecurity shows significant improvement
In 2023, organizations detected intrusions within a median of 10 days, a notable decrease from 16 days in 2022. Shorter dwell times are likely driven by a larger proportion of ransomware incidents in 2023 (23%) versus 2022 (18%).
Mandiant also tracked an improvement in internal detection of compromise in 2023 (46%), compared to 37% in 2022. These two trends – shorter dwell times and more internally detected events – suggest that defenders globally have improved detection capabilities.
“Attackers regularly adjust their tactics, techniques, and procedures in order to achieve their objectives, which can be challenging for defenders. Despite this, our frontline investigators have learned that organizations have done a better job in 2023 at protecting systems and detecting compromises,” said Jurgen Kutscher, VP, Mandiant Consulting at Google Cloud.
Kutscher continued, “Defenders should be proud, but organizations must remain vigilant. A key theme throughout M-Trends 2024 is that attackers are taking steps to evade detection and remain on systems for longer, and one of the ways they accomplish this is through the use of zero-day vulnerabilities. This further highlights the importance of an effective threat hunt program, as well as the need for comprehensive investigations and remediation in the event of a breach.”
Attacker median dwell time varies by region
Organizations in the Asia-Pacific (JAPAC) region experienced the most dramatic decrease, reducing their median dwell time to 9 days, compared to 33 days in 2022.
This variation could be driven by the quick moving ransomware used in the incidents in the region, as ransomware-related intrusions consumed the highest majority for the investigation type compared to any other region in 2023.
Conversely, the EMEA region (Europe, the Middle East and Africa) saw a slight rise in dwell time, increasing from 20 days to 22 days. This small variation could be the result of regional data normalizing following the notable portion of Mandiant’s work in Ukraine in 2022.
The report highlights key trends in industry targeting by cyber attackers. Mandiant most frequently responded to intrusions at financial services organizations (17%) in 2023. Following this sector were business and professional services (13%), high technology (12%), retail and hospitality (9%), and healthcare (8%).
A common thread across the top targeted industries is their possession of a wealth of sensitive information, including proprietary business data, personally identifiable information, protected health information, and financial records. This makes them particularly attractive targets for attackers seeking to exploit this type of sensitive data.
In an effort to maintain persistence on networks for as long as possible, attackers are increasingly targeting edge devices, leveraging “living off the land” techniques and exploiting zero day vulnerabilities.
China-nexus espionage groups are continuing to prioritize acquiring zero-day exploits and platform-specific tools. They will likely target edge devices and platforms with minimal security solutions due to the ease of compromising them undetected and for a longer period of time.
Zero-Day exploits on the rise
Zero-day exploits are no longer limited to a few, select actors. The trend of increasing availability is expected to continue due to factors like ransomware and data extortion groups utilizing them, continued state-sponsored exploitation, and the rise of commercially available “turnkey” exploit kits.
As cloud adoption grows, so does attacker targeting of these environments, including hybrid cloud/on-premise configurations. Organizations are advised to implement stricter controls to limit access to cloud resources by only authorized users.
Like other cybersecurity professionals, Red Teams can leverage LLMs and AI in their work. Use cases could involve Red Teams generating data for model training while AI developers find ways to secure access to trained models. This synergy could significantly enhance Red Team effectiveness and improve organizational preparedness against cyber threats.
As multi-factor authentication (MFA) becomes standard practice, attackers are developing methods to circumvent its protections. A concerning trend is the rise of web proxy and adversary-in-the-middle (AiTM) phishing pages that steal login session tokens, effectively bypassing MFA.