Rising Identity-Based Threats: Key Insights from Talos IR Q3 2024 Report

Introduction

The latest Cisco Talos Incident Response (Talos IR) report for Q3 2024 uncovers alarming trends in identity-based attacks and ransomware operations. With threats evolving rapidly, organizations face unprecedented challenges in defending their networks. This quarter, credential theft emerged as the primary objective in a significant portion of incidents, underscoring the sophistication and effectiveness of attackers utilizing various tactics.

Identity-Based Attacks on the Rise

Identity-based attacks are increasingly dominating the threat landscape, affecting a wide range of organizations. According to Talos IR, around 25% of incident responses involved credential theft, primarily facilitated through techniques such as living-off-the-land binaries (LoLBins), command line utilities, and open-source applications. The simplicity with which these methods can be employed has led to a considerable uptick in attacks.

Password spraying campaigns are a notable method adopted by adversaries to gain access. This approach involves using a small number of common passwords across numerous accounts, thus avoiding detection mechanisms that typically trigger lockouts when multiple failed login attempts occur on a single account. As a result, organizations need to bolster their security measures, emphasizing multi-factor authentication (MFA) and stringent password policies.

MFA Challenges and Phishing Attacks

Talos IR has also reported a rise in adversary-in-the-middle (AitM) phishing attacks this quarter. In several incidents, phishing emails directed victims to counterfeit login pages that impersonated legitimate platforms, such as Microsoft O365. Once on these sites, victims inadvertently provided their credentials, allowing attackers to swiftly initiate unauthorized access. Notably, in one instance, adversaries logged in just 20 minutes after the phishing email was sent, showcasing how quickly these attacks can unfold.

Ransomware Trends

This quarter, ransomware-related incidents — including pre-ransomware and data theft extortion incidents — constituted nearly 40% of Talos IR engagements. New ransomware variants, including RansomHub and RCRU64, emerged alongside previously seen types such as BlackByte and Cerber, indicating a growing and disorganized landscape of ransomware threats.

Ransomware operators continue to exploit known vulnerabilities. For instance, the exploitation of the ESXi hypervisor vulnerability, CVE-2024-37085, allowed adversaries to create unauthorized admin accounts, enabling them to deploy ransomware. The data reveals a troubling trend where attackers are increasingly employing publicly available tools, such as fgdump and pwdump, to obtain credentials following initial access.

Furthermore, the RCRU64 variant used stolen credentials to infiltrate systems with exposed remote desktop protocol (RDP) accounts, also showcasing the ease of access when organizations expose critical services. This quarter, the democratization of ransomware tools has made it easier for less sophisticated actors to engage in extortion efforts.

Sector-Specific Targeting

Data shows that organizations in the education, manufacturing, and financial services sectors have been the most frequently targeted, collectively accounting for over 30% of compromise incidents. This trend mirrors earlier findings from Q1 2024, highlighting the ongoing vulnerabilities within these particular industries. Additionally, valid account usage has emerged as the primary vector for initial access, accounting for 66% of engagement analyses.

Exploiting Industry Vulnerabilities

The report illustrates that adversaries are exploiting security weaknesses heavily. Nearly 40% of compromises occurred due to misconfigured MFA, while 100% of engagements involving phishing incidents displayed a bypass or lack of proper MFA protocols. Furthermore, security misconfigurations concerning endpoint detection and response (EDR) systems have accounted for about 30% of incidents, emphasizing the critical need for organizations to regularly audit and update their security measures.

Initial Access Mechanics

Initial access strategies are evolving, with adversaries demonstrating a marked preference for leveraging valid accounts. Among engagements where initial access could be discerned, the use of compromised credentials continued to dominate, albeit with a slight increase compared to the prior quarter. In addition to account exploitation, around 20% of incidents involved adversaries taking advantage of vulnerabilities in publicly accessible applications for access.

Emerging Threats and Security Posture

Looking ahead, a notable trend has emerged in the continuing targeted attacks against critical infrastructure. Talos IR observed actors employing sophisticated strategies to exploit known vulnerabilities in internet-facing web servers, particularly those associated with F5 BIG-IP network appliances. This underscores the importance of robust patching regimes and reevaluating the security posture of network devices, which present considerable attack surfaces.

Insights from MITRE ATT&CK Techniques

As part of their analysis, Talos IR identified notable MITRE ATT&CK techniques used by adversaries this quarter. Key observations from the data include:

• Adversaries increasingly leveraged reconnaissance tactics to gather credentials, contributing to identity-based attacks.
• About 20% of incidents involved the use of proxies for command and control (C2) operations.
• There has been a marked decline in the use of remote access software, such as AnyDesk, which was used in less than 5% of engagements this quarter compared to 35% previously.

Conclusion

The Q3 2024 Talos IR report paints a stark picture of the increasing sophistication of cyber attacks, particularly in the arena of identity-based threats and ransomware. As adversaries adapt their strategies with alarming speed, organizations must prioritize security fundamentals, including MFA and effective endpoint solutions, to mitigate risks. Continuous vigilance and proactive security measures are essential in this evolving landscape of cyber threats. Looking ahead, organizations should be prepared for new challenges and refine their defenses against the persistent threat posed by ransomware operations and identity-based attacks.