Cisco Talos 2023 Year in Review

Keypoints

• Annual cybersecurity reports are structured into sections covering telemetry trends, ransomware/extortion activities, network infrastructure threats, regional APT activities, and common malware loader behaviors, providing comprehensive insights into the threat landscape.
• These reports often present statistical data, such as the percentage of incidents related to ransomware (around 20%), the dominance of groups like LockBit, and the targeting of high-value assets like network devices and healthcare systems.
• Key trends include the persistent use of commodity payload loaders such as Qakbot and IcedID, the exploitation of older vulnerabilities in platforms like Microsoft Office and Exchange, and a notable increase in network device targeting through known security flaws and weak credentials.
• Geopolitical factors significantly influence APT activities, with Chinese and Russian groups demonstrating increased operational willingness during major world events, including targeting critical infrastructure in geostrategic regions like Taiwan, Ukraine, and the Middle East.
• Law enforcement actions temporarily disrupt ransomware operations, but threat actors rapidly adapt by rebranding or joining different RaaS groups, complicating attribution and mitigation efforts across the cybersecurity community.
• Reported statistics show a continued shift toward data extortion methods, with some groups abandoning ransomware altogether in favor of leak-and-still-threat tactics, reflecting evolving attacker strategies influenced by law enforcement crackdowns and detection improvements.
• Common attack techniques analyzed include hijacking execution flows, use of valid accounts, resource hijacking, and tactics for defense evasion, emphasizing the importance of patch management, credential security, and behavioral detection.
• Overall, these annual reports underscore the persistent and sophisticated nature of threats like LockBit, Clop, and other actors exploiting zero-days, with an emphasis on the need for proactive defense, timely patching, and strategic threat intelligence.