❌

Normal view

Before yesterdayMain stream

Security Operations – Sophos News
The Bite from Inside: The Sophos Active Adversary Report 12 December 2024 at 08:00

The Bite from Inside: The Sophos Active Adversary Report

Security Operations – Sophos News

12 December 2024 at 08:00

A sea change in available data fuels fresh insights from the first half of 2024

A bar chart showing an increase in LOLbins in the span between 2021 and the first half of 2024; the totals increased from just over 100 to nearly 190

A stacked bar chart showing the relationship between artifact and LOLbin counts between 2021 and the first half of 2024, as described in text

A bar chart showing the prevalence of the top 29 LOLbins noted in the first half of 2024, ranging from RDP at just under 90 percent to findstr.exe at 10 percent

A table showing the changes in prevalence of the top 29 1H24 LOLbins between 2023 and the first half of the year; all but five of the listed LOLbins increased in frequency of usage

A table showing RDP usage in attacks in 2022, 2023, and the first half of 2024

Five funnel-shaped charts showing the prevalence of ransomware attributions between 2020 and the first half of 2024; in this format they resemble different types of trees as described in text

A table showing the root causes of 1H24 cases for the entire report, for IR's portion of the data, and for MDR's portion of the data

A table showing changes in artifact prevalence in AAR cases from 2021 to the first half of 2024

A world map showing locations in which cases appearing in this report occurred

Threat Research – Sophos News
The Bite from Inside: The Sophos Active Adversary Report 12 December 2024 at 08:00

The Bite from Inside: The Sophos Active Adversary Report

Threat Research – Sophos News

12 December 2024 at 08:00

A sea change in available data fuels fresh insights from the first half of 2024

A bar chart showing an increase in LOLbins in the span between 2021 and the first half of 2024; the totals increased from just over 100 to nearly 190

A stacked bar chart showing the relationship between artifact and LOLbin counts between 2021 and the first half of 2024, as described in text

A bar chart showing the prevalence of the top 29 LOLbins noted in the first half of 2024, ranging from RDP at just under 90 percent to findstr.exe at 10 percent

A table showing the changes in prevalence of the top 29 1H24 LOLbins between 2023 and the first half of the year; all but five of the listed LOLbins increased in frequency of usage

A table showing RDP usage in attacks in 2022, 2023, and the first half of 2024

Five funnel-shaped charts showing the prevalence of ransomware attributions between 2020 and the first half of 2024; in this format they resemble different types of trees as described in text

A table showing the root causes of 1H24 cases for the entire report, for IR's portion of the data, and for MDR's portion of the data

A table showing changes in artifact prevalence in AAR cases from 2021 to the first half of 2024

A world map showing locations in which cases appearing in this report occurred