Common tool combinations used in attacks provide a powerful warning signal of intruder activity.Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020 While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement.

Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously

Longer dwell times and open entry points leave organizations vulnerable to multiple attackers.

Organizations in the education sector or with fewer than 500 employees also had longer dwell times For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. The median dwell time for organizations hit by ransomware was 11 days.

The median attacker dwell time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources.

Sophos reviews reddit