Fortinet Global Threat Report Second Half 2023

Keypoints

• Cybersecurity reports from major vendors are structured into key sections such as executive summaries, active threat landscape overviews, exploit and malware trend analyses, threat actor activities (including APT groups), vulnerability assessments, and future threat predictions, providing a holistic view of the cyber risk environment.
• These reports present critical statistics, revealing that approximately 41% of organizations detect exploits that are less than a month old, indicating the rapid pace of attack evolution and the importance of timely threat detection.
• Organizations are consistently targeted by a broad array of exploit techniques, with over 73% experiencing severe attacks related to vulnerabilities in IoT devices, web applications, and networking equipment, emphasizing the need for prioritized vulnerability management.
• Trends show a rising number of exploitation attempts against older vulnerabilities, with 98% of organizations detecting exploits that have existed for at least five years, demonstrating the persistent exploitation of legacy weaknesses alongside emerging threats.
• Analysis of malware family activity indicates that certain families like JS/Agent and JS/Cryxos are prevalent globally, with regional variations, and that new malware campaigns and botnets such as AndroxGh0st, Prometei, and DarkGate continue to emerge, underlining the evolving threat landscape.
• Threat intelligence covers sophisticated APT campaigns by groups like Lazarus and APT 28, which exploit both known vulnerabilities and custom malware—highlighting the necessity for advanced detection and tracking strategies.
• The reports emphasize the importance of focusing remediation efforts on the ‘red zone’ vulnerabilities—those with high exploit activity—given the record number of new vulnerabilities (over 30,000 in 2023) and the critical need for rapid patching, especially for high-risk platforms like Microsoft and Oracle.
• Predictive systems, such as the Exploit Prediction Scoring System (EPSS), are validated as effective tools for estimating vulnerability exploit likelihood, demonstrated by early warnings before real-world attacks—supporting proactive defense strategies.
• Overall, these vendor reports highlight ongoing threats from both new and old vulnerabilities, targeted malware campaigns, and resilient botnets, demanding continuous evolution of cybersecurity defenses and vulnerability management.