TMCnet News
Mandiant's M-Trends Report Reveals New Insights from Frontline Cyber InvestigationsGlobal median dwell time falls to its lowest point in over a decade; Financial Services is the most targeted sector by attackers SUNNYVALE, Calif., April 23, 2024 /PRNewswire/ -- Mandiant, part of Google Cloud, today released the findings of its M-Trends 2024 report. Now in its 15th year, this annual report provides expert trend analysis based on Mandiant frontline cyber attack investigations and remediations conducted in 2023. The 2024 report reveals evidence that organizations globally have made meaningful improvements in their defensive capabilities, identifying malicious activity affecting their organization more quickly than in previous years. The report also takes a look at notable threat actors and campaigns, providing a focused look at threat activity by region. "Attackers regularly adjust their tactics, techniques, and procedures in order to achieve their objectives, which can be challenging for defenders. Despite this, our frontline investigators have learned that organizations have done a better job in 2023 at protecting systems and detecting compromises," said Jurgen Kutscher, Vice President, Mandiant Consulting at Google Cloud. Kutscher continued, "Defenders should be proud, but organizations must remain vigilant. A key theme throughout M-Trends 2024 is that attackers are taking steps to evade detection and remain on systems for longer, and one of the ways they accomplish this is through the use of zero-day vulnerabilities. This further highlights the importance of an effective threat hunt program, as well as the need for comprehensive investigations and remediation in the event of a breach." Global Median Dwell Time Hits Lowest Point Recorded While the use of zero-day exploits is on the rise, the M-Trends 2024 report reveals a significant improvement in global cybersecurity posture. The global median dwell time – the time attackers remain undetected within a target environment – has reached its lowest point in over a decade. In 2023, organizations detected intrusions within a median of 10 days, a notable decrease from 16 days in 2022. Shorter dwell times are likely driven by a larger proportion of ransomware incidents in 2023 (23%) versus 2022 (18%). Mandiant also tracked an improvement in internal detection of compromise in 2023 (46%), compared to 37% in 2022. These two trends - shorter dwell times and more internally detected events - suggest that defenders globally have improved detection capabilities. Dwell Time By Region A closer examination reveals that median dwell time varies by region. Organizations in the Asia-Pacific (JAPAC) region experienced the most dramatic decrease, reducing their median dwell time to 9 days, compared to 33 days in 2022. This variation could be driven by the quick moving ransomware used in the incidents in the region, as ransomware-related intrusions consumed the highest majority for the investigation type compared to any other region in 2023. Conversely, the EMEA region (Europe, the Middle East and Africa) saw a slight rise in dwell time, increasing from 20 days to 22 days. This small variation could be the result of regional data normalizing following the notable portion of Mandiant's work in Ukraine in 2022. Targeting By Industry Vertical The M-Trends 2024 report highlights key trends in industry targeting by cyber attackers. Mandiant most frequently responded to intrusions at financial services organizations (17%) in 2023. Following this sector were business and professional services (13%), high technology (12%), retail and hospitality (9%), and healthcare (8%). A common thread across the top targeted industries is their possession of a wealth of sensitive information, including proprietary business data, personally identifiable information, protected health information, and financial records. This makes them particularly attractive targets for attackers seeking to exploit this type of sensitive data. Additional report takeaways include:
M-Trends 2024 Methodology The metrics reported in M-Trends 2024 are based on Mandiant Consulting investigations of targeted attack activity conducted between January 1, 2023 and December 31, 2023. The intelligence gleaned has been sanitized to protect the identities of targets and their data. Resources M-Trends 2024 Report: https://cloud.google.com/security/m-trends About Mandiant Mandiant is a recognized leader in dynamic cyber defense, threat intelligence and incident response services. By scaling decades of frontline experience, Mandiant helps organizations to be confident in their readiness to defend against and respond to cyber threats. Mandiant is part of Google Cloud. About Google Cloud Google Cloud is the new way to the cloud, providing AI, infrastructure, developer, data, security, and collaboration tools built for today and tomorrow. Google Cloud offers a powerful, fully integrated and optimized AI stack with its own planet-scale infrastructure, custom-built chips, generative AI models and development platform, as well as AI-powered applications, to help organizations transform. Customers in more than 200 countries and territories turn to Google Cloud as their trusted technology partner.
View original content to download multimedia:https://www.prnewswire.com/news-releases/mandiants-m-trends-report-reveals-new-insights-from-frontline-cyber-investigations-302123736.html SOURCE Mandiant, part of Google Cloud |