It was the second consecutive year the manufacturing sector held the top spot in the index.
IBM says manufacturing organizations are an attractive target for ransomware and extortion, because of the extremely low tolerance for down time.
Operational Technology (OT) Vulnerabilities
Industrial control systems (ICS) vulnerabilities discovered in 2022 decreased for the first time in two years—457 in 2022 compared to 715 in 2021 and 472 in 2020. One explanation is ICS lifecycles and how they’re managed and patched. Attackers know that long equipment lifecycles and older, less-supported software mean many ICS components and OT networks are still at risk of older vulnerabilities. Infrastructure is usually in place for many years longer than standard office workstations, which extends the lifespan of ICS-specific vulnerabilities beyond other vulnerabilities that exploit IT.
2022 saw the discovery of two new OT-specific pieces of malware: Industroyer2 and INCONTROLLER, also known as PIPEDREAM, and the disclosure of many OT vulnerabilities called OT:ICEFALL. The OT cyberthreat landscape is expanding dramatically, and OT asset owners and operators need to be keenly aware of the shifting landscape.
Looking at the subset of incidents in OT-related industries, manufacturing was victimized in 58 percent of incidents X-Force assisted in remediating. Deployment of backdoors was the top action, identified in 28 percent of cases in the manufacturing sector.
Another major vulnerability exploited in OT is lack of proper segmentation between OT and IT networks. These environments include targeting jump servers, dual-homed operator workstations and reporting servers, such as data historians that expose web and SQL services from OT to corporate IT networks. Properly segmenting these portions of your networks and closely monitoring communication between them can keep assets safe.
The index shows that while ransomware's share of incidents declined only slightly (four percentage points) from 2021 to 2022, defenders were more successful detecting and preventing ransomware. Despite this, attackers continued to innovate, with the average time to complete a ransomware attack dropping from two months to less than four days.
According to the report, the deployment of backdoors—which allow remote access to systems—aws the top action by attackers last year. About 67 percent of those backdoor cases related to ransomware attempts, where defenders were able to detect the backdoor before ransomware was deployed. The uptick in backdoor deployments can be partially attributed to their high market value. X-Force observed threat actors selling existing backdoor access for as much as $10,000, compared to stolen credit card data, which can sell for less than $10 today.
"The shift towards detection and response has allowed defenders to disrupt adversaries earlier in the attack chain—tempering ransomware's progression in the short term," said Charles Henderson, Head of IBM Security X-Force. "But it's only a matter of time before today's backdoor problem becomes tomorrow's ransomware crisis. Attackers always find new ways to evade detection. Good defense is no longer enough. To break free from the never-ending rat race with attackers, businesses must drive a proactive, threat-driven security strategy."
The IBM Security X-Force Threat Intelligence Index tracks new and existing trends and attack patterns, pulling from billions of datapoints from network and endpoint devices, incident response engagements and other sources.
Key findings in the 2023 report:
Extortion is the go-to method
The most common impact from cyberattacks in 2022 was extortion, which was primarily achieved through ransomware or business email compromise attacks. Europe was the most targeted region for this method, representing 44 percent of extortion cases observed, as threat actors sought to exploit geopolitical tensions.
Cybercriminals weaponize email conversations
Thread hijacking saw a significant rise in 2022, with attackers using compromised email accounts to reply within ongoing conversations posing as the original participant. X-Force observed the rate of monthly attempts doubled compared to 2021 data.
Legacy exploits are still doing harm
The proportion of known exploits relative to vulnerabilities declined 10 percentage points from 2018 to 2022 The findings indicate that legacy exploits enabled older malware infections such as WannaCry and Conficker to continue to exist and spread.
Downstream Extortion Pressure
Cybercriminals often target the most vulnerable industries, businesses, and regions with extortion schemes, applying high psychological pressure to force victims to pay. Ransomware is a well-known method of extortion, but threat actors are always exploring new ways to extort victims. One of the latest tactics involves making stolen data more accessible to downstream victims. By bringing customers and business partners into the mix, operators increase pressure on the breached organization. Threat actors will continue experimenting with downstream victim notifications to increase the potential costs and psychological impact of an intrusion, making it critical that businesses have a customized incident response plan that also considers the impact of an attack on downstream victims.
Thread Hijacking on the Rise
Over the year, X-Force found that attackers used this tactic to deliver Emotet, Qakbot, and IcedID, malicious software that often results in ransomware infections. With phishing being the leading cause of cyberattacks last year, and thread hijacking's sharp rise, it's clear that attackers are exploiting the trust placed in email. Businesses should make employees aware of thread hijacking to help reduce the risk of them falling victim.
Exploit "R&D" Lagging Vulnerabilities
The ratio of known exploits to vulnerabilities has been declining over the last few years, down 10 percentage points since 2018. Cybercriminals already have access to more than 78,000 known exploits, making it easier to exploit older, unpatched vulnerabilities. Even after five years, vulnerabilities leading to WannaCry infections remain a significant threat. There was an 800 percent increase in WannaCry ransomware traffic within MSS telemetry data since April 2022. The continued use of older exploits highlights the need for organizations to refine and mature vulnerability management programs, including better understanding their attack surface and risk-based prioritization of patches.
Additional findings from the 2023 report include:
North America Felt Brunt of Energy Attacks. Energy held its spot as the 4th most attacked industry last year, as global forces continue to affect an already tumultuous global energy trade. North American energy organizations accounted for 46% of all energy attacks observed last year, a 25% increase from 2021 levels.
Asia Tops the Target List. Accounting for nearly one-third of all attacks that X-Force responded to in 2022, Asia saw more cyberattacks than any other region. Manufacturing accounted for nearly half of all cases observed in Asia last year.