Rapid7 Attack Intelligence Report 2024

Keypoints

• Major annual cybersecurity reports typically consist of sections such as an executive summary, threat landscape overview, vulnerability exploitation trends, attack techniques, attacker utilities, vulnerability classes, practical guidance, and appendices with methodology and references.
• These reports often begin with a high-level summary of recent threat activity, followed by detailed data on exploited vulnerabilities, attack vectors, and notable incidents from the past year.
• Key statistics include a significant proportion of exploits involving zero-day vulnerabilities—53% of new widespread threats in 2023 were exploited pre-patch, returning to 2021 levels.
• There is a notable increase in mass compromises originating from sophisticated zero-day attacks executed by well-organized threat actors using custom tools and exploits, targeting both network edge devices and supply chain components.
• Data shows the median time between vulnerability disclosure and first exploitation remains very short—around one day—highlighting the urgency for rapid patching and proactive defense measures.
• The trend toward targeted, high-skill exploits by nation-state actors has escalated, with incidents involving ransomware groups such as Cl0p and advanced persistent threats (APTs) conducting long-term espionage campaigns.
• Exploited vulnerabilities often stem from common coding issues like command injection and authentication bypasses, simplifying attack success for less skilled adversaries despite some highly targeted zero-day exploits.
• Organizations are encouraged to implement multi-factor authentication and maintain vigilant patch management, especially on internet-facing systems, to mitigate the increasing sophistication of threat activities.
• Vulnerability classes show a high prevalence of deserialization issues, command injections, and privilege escalations, with vendors improving incident response times and patching practices due to recent high-profile breaches.
• The reports underscore the importance of human expertise alongside technology, noting rising risks due to burnout and industry retreat into private vulnerability disclosures.