❌

Normal view

Yesterday — 14 April 2025Main stream

Threat Research – Sophos News
It takes two: The 2025 Sophos Active Adversary Report 2 April 2025 at 05:01

It takes two: The 2025 Sophos Active Adversary Report

Threat Research – Sophos News

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

A sidebar (callout box) that says: Rather than read this edition of the Active Adversary Report in PDF format? Click here to reach a (non-gated) PDF version of this page.

A sidebar (callout) box that says: IR and MDR: What’s the difference? Though both of the datasets we use are derived from response activity, there is a critical difference in how they are generated. IR data comes from customers who come to us without MDR services already in place; they may call us when they suspect an incident is underway, or they may simply be referred by their insurance company or otherwise familiar with Sophos. MDR data comes from current managed customers (so, customers with at least some Sophos monitoring and logging services in place) who need incident response to neutralize active threats and remediate the actions of attackers; in almost all cases, we initiate notice to them that something bad is happening.

A line chart showing, for the five years 2020-24, attack types observed by Sophos responders. A rise in network breaches and decline in ransomware incidents in the past year is discussed in text. The other nine attack types seen in our reports are a pile of spaghetti at the bottom of the graphic, with none of those root causes represented in more than 8 percent of cases in any given year.

Three tables showing, for MDR + IR in 2024, the root causes of investigated incidents. It is divided into IR-only, MDR-only, and combined data. As covered in text, compromised credentials were the leading root cause for both IR and MDR cases.

Four stacked bar charts showing, for the years 2021-24, the ascribed root causes of incidents. The stacks add up to 100 percent for each year. The findings are discussed in the report text.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the artifact data category. It is divided into IR-only, MDR-only, and combined data. There is a 60 percent overlap between MDR and IR artifact findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the LOLBin data category. It is divided into IR-only, MDR-only, and combined data. There is a 70 percent overlap between MDR and IR LOLBin findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings not covered in the Artifact or LOLBin data categories. It is divided into IR-only, MDR-only, and combined data. There is an 80 percent overlap between MDR and IR Other findings.

A table showing ransomware attributions seen in MDR + IR data for 1H24, 2H24, and for the whole year. Chart shows only ransomware families seen in more than two percent of cases; conclusions re data are discussed in text

A bar chart showing remote ransomware incidents by month from September 2021 through December 2024; a sharp rise starting in the second half of 2023 is visible

A table with three lists showing attack impact in IR data 2020-23, in IR + MDR data 2024, and for the full five-year time period, by percentage

A world map showing the nations and other locations listed in the table immediately below

Security Operations – Sophos News
It takes two: The 2025 Sophos Active Adversary Report 2 April 2025 at 05:01

It takes two: The 2025 Sophos Active Adversary Report

Security Operations – Sophos News

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

A sidebar (callout box) that says: Rather than read this edition of the Active Adversary Report in PDF format? Click here to reach a (non-gated) PDF version of this page.

A sidebar (callout) box that says: IR and MDR: What’s the difference? Though both of the datasets we use are derived from response activity, there is a critical difference in how they are generated. IR data comes from customers who come to us without MDR services already in place; they may call us when they suspect an incident is underway, or they may simply be referred by their insurance company or otherwise familiar with Sophos. MDR data comes from current managed customers (so, customers with at least some Sophos monitoring and logging services in place) who need incident response to neutralize active threats and remediate the actions of attackers; in almost all cases, we initiate notice to them that something bad is happening.

A line chart showing, for the five years 2020-24, attack types observed by Sophos responders. A rise in network breaches and decline in ransomware incidents in the past year is discussed in text. The other nine attack types seen in our reports are a pile of spaghetti at the bottom of the graphic, with none of those root causes represented in more than 8 percent of cases in any given year.

Three tables showing, for MDR + IR in 2024, the root causes of investigated incidents. It is divided into IR-only, MDR-only, and combined data. As covered in text, compromised credentials were the leading root cause for both IR and MDR cases.

Four stacked bar charts showing, for the years 2021-24, the ascribed root causes of incidents. The stacks add up to 100 percent for each year. The findings are discussed in the report text.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the artifact data category. It is divided into IR-only, MDR-only, and combined data. There is a 60 percent overlap between MDR and IR artifact findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the LOLBin data category. It is divided into IR-only, MDR-only, and combined data. There is a 70 percent overlap between MDR and IR LOLBin findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings not covered in the Artifact or LOLBin data categories. It is divided into IR-only, MDR-only, and combined data. There is an 80 percent overlap between MDR and IR Other findings.

A table showing ransomware attributions seen in MDR + IR data for 1H24, 2H24, and for the whole year. Chart shows only ransomware families seen in more than two percent of cases; conclusions re data are discussed in text

A bar chart showing remote ransomware incidents by month from September 2021 through December 2024; a sharp rise starting in the second half of 2023 is visible

A table with three lists showing attack impact in IR data 2020-23, in IR + MDR data 2024, and for the full five-year time period, by percentage

A world map showing the nations and other locations listed in the table immediately below

Before yesterdayMain stream

Security Operations – Sophos News
The Bite from Inside: The Sophos Active Adversary Report 12 December 2024 at 08:00

The Bite from Inside: The Sophos Active Adversary Report

Security Operations – Sophos News

12 December 2024 at 08:00

A sea change in available data fuels fresh insights from the first half of 2024

A bar chart showing an increase in LOLbins in the span between 2021 and the first half of 2024; the totals increased from just over 100 to nearly 190

A stacked bar chart showing the relationship between artifact and LOLbin counts between 2021 and the first half of 2024, as described in text

A bar chart showing the prevalence of the top 29 LOLbins noted in the first half of 2024, ranging from RDP at just under 90 percent to findstr.exe at 10 percent

A table showing the changes in prevalence of the top 29 1H24 LOLbins between 2023 and the first half of the year; all but five of the listed LOLbins increased in frequency of usage

A table showing RDP usage in attacks in 2022, 2023, and the first half of 2024

Five funnel-shaped charts showing the prevalence of ransomware attributions between 2020 and the first half of 2024; in this format they resemble different types of trees as described in text

A table showing the root causes of 1H24 cases for the entire report, for IR's portion of the data, and for MDR's portion of the data

A table showing changes in artifact prevalence in AAR cases from 2021 to the first half of 2024

A world map showing locations in which cases appearing in this report occurred

Threat Research – Sophos News
The Bite from Inside: The Sophos Active Adversary Report 12 December 2024 at 08:00

The Bite from Inside: The Sophos Active Adversary Report

Threat Research – Sophos News

12 December 2024 at 08:00

A sea change in available data fuels fresh insights from the first half of 2024

A bar chart showing an increase in LOLbins in the span between 2021 and the first half of 2024; the totals increased from just over 100 to nearly 190

A stacked bar chart showing the relationship between artifact and LOLbin counts between 2021 and the first half of 2024, as described in text

A bar chart showing the prevalence of the top 29 LOLbins noted in the first half of 2024, ranging from RDP at just under 90 percent to findstr.exe at 10 percent

A table showing the changes in prevalence of the top 29 1H24 LOLbins between 2023 and the first half of the year; all but five of the listed LOLbins increased in frequency of usage

A table showing RDP usage in attacks in 2022, 2023, and the first half of 2024

Five funnel-shaped charts showing the prevalence of ransomware attributions between 2020 and the first half of 2024; in this format they resemble different types of trees as described in text

A table showing the root causes of 1H24 cases for the entire report, for IR's portion of the data, and for MDR's portion of the data

A table showing changes in artifact prevalence in AAR cases from 2021 to the first half of 2024

A world map showing locations in which cases appearing in this report occurred