Nearly half of organizations that suffered a “significant” digital attack fell victim to bad actors again within a year’s time, a new security trends report revealed.
According to Mandiant’s “M-Trends 2018” report, 49 percent of managed detection and response customers that remediated a large-scale attack suffered an incident from the same or a similarly motivated threat group within one year. The initial assaults consisted of data theft, credential harvesting and spear phishing, among other techniques.
Unpacking Repeat Cyberattack Trends
Mandiant admitted to not having looked at recompromise figures since it released its “M-Trends 2013” study five years ago. That report found that 38 percent of clients had suffered another attack after successful remediation.
The number of follow-up attacks were somewhat higher in 2017: 56 percent of customers weathered at least one significant attack from the same threat group or one like it. At the same time, the vast majority (86 percent) of organizations that remediated more than one significant cyberattack hosted more than one unique bad actor in their IT environment.
Some regional differences were apparent over the course of the year. Less than half of customers in the Americas and Europe, Middle East and Africa (EMEA) experienced another attack of consequence and/or multiple threat actors. By contrast, 91 percent of Asia-Pacific (APAC) clients dealt with a subsequent campaign, while 82 percent of organizations from that region suffered a significant attack from multiple groups.
The Good News and Bad News About Dwell Time
Dwell time, or the average number of days during which attackers lurked in a victim’s network prior to detection, increased across several regions in 2017, according to the report. The APAC average increased nearly three times, from 172 days to 489 days. The EMEA dwell time growth was more modest at 40 percent, from 106 days to 175 days.
Stuart McKenzie, vice president of Mandiant at FireEye, expressed disappointment in the growth of the median EMEA dwell time but noted that it’s not all bad news.
“On the positive side, we’ve seen a growing number of historic threats uncovered this year that have been active for several hundred days,” McKenzie said, as quoted by Infosecurity Magazine. “Detecting these long-lasting attacks is obviously a positive development, but it increases the dwell time statistic.”
During the same survey period, the dwell time for the Americas decreased from 99 days to 75.5 days. The average across all regions rose slightly from 99 days to 101 days.
Looking Ahead
In the report, Mandiant shared its prediction that foreign digital espionage groups will continue to prey upon U.S. companies and service providers in 2017. It also predicted that bad actors will target the software supply chain to spy on developers and software-makers over the course of the year.