TrelliX Advanced Threat Research Report 2024

Keypoints

• Annual cybersecurity reports are structured into key sections such as foreword, methodology, threat landscape analysis, and detailed insights on threat actors, tools, and targeted regions, offering a comprehensive overview of the cyber threat environment.
• These reports present critical statistics, like the 17% increase in APT detections in six months and over 21 million detections from China-linked groups, indicating heightened state-sponsored cyber activity and increased targeting of government sectors.
• Notable trends include a sharp rise in Sandworm activity by over 1600%, expansion of China’s prolific APT operations, and diversification of targeted countries including Turkey, India, and others, reflecting strategic shifts driven by geopolitical events.
• The ransomware landscape is increasingly disrupted by law enforcement actions, with new tactics like EDR killers (e.g., Spyboy’s Terminator) emerging to evade detection, alongside targeted sectors such as transportation, shipping, and telecoms.
• The reports emphasize the growing use of AI-powered tools and legitimate system tools (“living off the land”), enhancing threat actor capabilities to evade detection and conduct sophisticated cyber espionage and attacks.
• Significant insights show the evolution of malicious tools, with decreases in traditional web shells but increases in “other” less detectable tools, indicating threat actors’ adaptation to cybersecurity defenses.
• Geopolitical events, such as U.S.-China meetings, conflicts in Israel and Ukraine, and military drills, directly influence cyber activity, prompting surges in nation-state operations aligned with strategic objectives.
• Emerging threat actors from countries like Belarus and Pakistan, and a rise in “Other” groups, underscore the expanding and diversifying landscape of cyber adversaries worldwide.