Expel Annual Threat Report 2024

Keypoints

• The annual cybersecurity reports from major vendors typically include sections such as executive summaries, incident statistics, threat trends, industry-specific risks, and future predictions, providing comprehensive insights into the evolving cyber landscape.
• 2024 reports reveal that identity threats remain the top concern, comprising 64% of all security incidents, with a 144% increase in volume from the previous year, primarily via malicious logins from suspicious infrastructure.
• Phishing remains a prevalent attack vector, with a notable rise in phishing-as-a-service platforms and QR code phishing tactics, especially targeting mobile devices and personal endpoints.
• Cloud infrastructure incidents surged by 72%, mainly due to leaked or stolen cloud credentials; misconfigurations of services like AWS Cognito enable significant breaches, highlighting the importance of proper setup and continuous monitoring.
• Malware threats, particularly pre-ransomware variants like Gootloader, Qakbot, and SocGholish, pose immediate risks, often delivered via malicious scripting files or through shadow IT and malvertising campaigns.
• Zero-day vulnerabilities such as CVE-2023-34362 and CVE-2023-4966 highlight the need for layered security controls, especially in high-impact environments like hospitality and finance industries targeted by specific campaigns.
• Attackers increasingly leverage script-based malware, malicious ads, and compromised third-party software, emphasizing the importance of defense-in-depth, user education, and strong authentication policies.
• Industry-targeted trends include high phishing activity in hospitality, travel, and financial services, with threat groups like “The Com” specializing in impersonation and MFA fatigue tactics to breach organizational defenses.
• Major insights stress proactive risk management, awareness of attack techniques, and adopting tight security controls such as phishing-resistant MFA, conditional access, and vigilant monitoring of login anomalies to protect organizational assets.