IBM X-Force Threat Intelligence Index 2024

Keypoints

• The typical structure of major cybersecurity reports, including the executive summary, report highlights, industry and geographic trends, technical attack vectors, and actionable recommendations, provides a comprehensive overview of the cyber threat landscape.
• These reports present key statistics such as a 30% increase in attacks using valid credentials, a notable drop in ransomware incidents despite increased extortion activities, and a surge in infostealer malware like Rhadamanthys and StrelaStealer.
• Major trends include the rising prominence of identity-based access techniques—particularly Kerberoasting, with a 100% increase—and the evolving tactics of malware delivery through email, malvertising, and abuse of cloud services like Notion and Discord for command-and-control channels.
• Web application vulnerabilities predominantly involve security misconfigurations (30%) and identification/authentication failures (21%), with frequent issues such as session hijacking potentials and weak password policies, highlighting the need for secure configurations and robust identity management.
• Shifts in attack objectives reveal malware deployment as the leading action (43%), with data theft, extortion, and credential harvesting as top impacts, emphasizing the importance of proactive detection of credential abuse and data exfiltration activities.
• Threat actors are increasingly exploiting both traditional and novel vectors, including supply chain breaches (e.g., MOVEit), zero-day vulnerabilities (though decreasing in frequency), and the strategic use of legitimate tools for malicious purposes, necessitating vigilant security hygiene and threat modeling.
• The report underscores the geopolitical dimension with sustained Russian state-sponsored cyber operations targeting Ukraine, along with analysis of threat actor retooling and capability enhancements, such as DNS fluxing and fileless malware techniques.
• Overall, these reports illustrate the dynamic nature of cyber threats, with recurring themes like identity compromise, web application risks, evolving malware delivery, and the expanding role of AI in both defensive and offensive cyber capabilities.