Falcon OverWatch calculated that the breakout time (i.e., the average time it takes an attacker to move from the initial compromise to other hosts within the victim environment) for eCrime attackers has dropped to 1 hour and 24 minutes, compared to 1 hour and 38 minutes as recently as Falcon OverWatch’s 2022 CrowdStrike Global Threat Report. In addition, the OverWatch team found that in about one-third (30%) of these eCrime attacks, the attacker was able to move laterally in less than 30 minutes. These findings underscore the speed and extent to which threat actors are evolving their tactics, techniques, and procedures (TTPs) and are able to circumvent even the most advanced technology-based defenses to successfully achieve their goals.

“Over the past 12 months, the world has faced new challenges triggered by economic pressures and geopolitical tensions, creating a threat landscape that is more complicated than ever before,” said Param Singh, vice president, Falcon OverWatch at CrowdStrike. “To thwart brazen threat actors, security teams must implement solutions that proactively scan for covert and advanced attacks at all hours of the day and night. Combining the CrowdStrike Falcon platform with the telemetry, tools, threat intelligence and human ingenuity of the Falcon OverWatch Threat Hunter protects organizations worldwide from the most sophisticated and hard-to-detect threats.”

Other key findings from the report include:

• eCrime is primarily responsible for interactive burglary campaigns. eCrime was responsible for 43 percent of interactive intrusions, while state actors accounted for 18 percent of activity. Hacktivists accounted for only one percent of interactive intrusion campaigns, while the remaining intrusions could not be attributed.
• Attackers are relying less and less on malware. Malware-free attacks accounted for 71 percent of all detections indexed by the CrowdStrike Threat Graph. The prevalence of malware-free attacks is related in part to the large-scale misuse of valid credentials by attackers to facilitate access to and retention in victim environments. Another factor is the speed at which new vulnerabilities are discovered and the speed at which attackers are able to implement exploits.
• The technology industry is the primary target industry for interactive attacks. The top five targeted industries are technology (19%), telecommunications (10%), manufacturing (7%), higher education (7%), and healthcare (7%). It is noteworthy that the technology industry was almost twice as likely to be the target of interactive intrusions as the second most targeted industry.
• The telecommunications sector is the most important industry for targeted attacks by state actors. The top five targeted industries are telecommunications (37%), technology (14%), government (9%), academia (5%), and media (4.5%). The telecommunications industry continues to be the target of state-sponsored surveillance, intelligence, and counterintelligence activities. In this context, the telecommunications industry experienced 163 percent more targeted interventions by state actors than the industry that was targeted second most often.
• Healthcare is in the crosshairs of Ransomware-as-a-Service (RaaS). The volume of attempted interactive attacks on healthcare has doubled from the previous year. The vast majority of these intrusions are attributed to eCrime.

The report covers the findings of Falcon OverWatch’s global threat hunting activities from July 1, 2021 to June 30, 2022, and includes detailed attack data and analysis, case studies, and actionable recommendations.

About CrowdStrike

CrowdStrike Holdings Inc (Nasdaq: CRWD), a global leader in cybersecurity, is redefining security in the cloud era with its workload, endpoint, identity and data protection platform designed from the ground up.

Powered by the CrowdStrike Security Cloud and best-in-class artificial intelligence, the CrowdStrike Falcon® platform can leverage real-time attack indicators, threat data, evolving attacker methodologies, and enriched telemetry data from across the enterprise to deliver highly accurate detections, automated protection and remediation, world-class threat hunting, and prioritized vulnerability monitoring.

Built specifically for the cloud, the Falcon platform has a single, lean agent and delivers rapid and scalable deployment, excellent protection and performance with reduced complexity and rapid time to value.

© 2022 CrowdStrike, Inc. all rights reserved. CrowdStrike, the Falcon logo, CrowdStrike Falcon and CrowdStrike Threat Graph are registered trademarks of CrowdStrike, Inc. and are registered in the United States Patent and Trademark Office and in other countries. CrowdStrike owns other trademarks and service marks and may use third party trademarks to identify its products and services.