Fortinet®, the global cybersecurity leader driving the convergence of networking and security, announced the latest semiannual Global Threat Landscape Report from FortiGuard Labs. In the first half of 2023, FortiGuard Labs observed a decline in organizations detecting ransomware, significant activity among advanced persistent threat (APT) groups, a shift in MITRE ATT&CK techniques used by attackers, and much more. In addition to the highlights below, readers can find the full analysis by reading the H1 2023 Global Threat Landscape Report.
While organizations continue to find themselves in a reactive position due to the growing sophistication of malicious actors and the escalation of targeted attacks, ongoing analysis of the threat landscape in the H1 2023 Global Threat Landscape Report helps provide valuable intelligence that can serve as an early warning system of potential threat activity and help security leaders prioritize their security strategy and patching efforts. Highlights of the report follow:
Ransomware, as Detected by Various Organizations, Is on the Decline: FortiGuard Labs has documented substantial spikes in ransomware variant growth in recent years, largely fueled by the adoption of Ransomware-as-a-Service (RaaS). However, FortiGuard Labs found that fewer organizations detected ransomware in the first half of 2023 (13%) compared to this time five years ago (22%). Despite the overall decline, organizations must keep their guard up. This supports the trend that FortiGuard Labs has seen over the last couple of years: that ransomware and other attacks are becoming increasingly more targeted thanks to the growing sophistication of attackers and the desire to increase the return on investment (ROI) per attack. Research also found that the volume of ransomware detections continues to be volatile, closing H1 2023 13x higher than the end of 2022 but still on a downward trend overall when comparing year-over-year.
Malicious Actors Are 327x More Likely to Attack Top EPSS Vulnerabilities Than All Other CVEs: Since its inception, Fortinet has been a core contributor of exploitation activity data in support of the Exploit Prediction Scoring System (EPSS). This project aims to leverage a myriad of data sources to predict the likelihood and when a vulnerability will be exploited in the wild. FortiGuard Labs analyzed six years of data spanning more than 11,000 published vulnerabilities that detected exploitation and found that the Common Vulnerabilities and Exposures (CVEs) categorized with a high EPSS score (top 1% severity) are 327x more likely to be exploited within seven days than any other vulnerability. This first-of-its-kind analysis can serve as the canary in the coal mine, giving CISOs and security teams an early indication of targeted attacks against their organizations. Like the Red Zone, introduced in the last Threat Landscape Report, this intelligence can help security teams systematically prioritize patching efforts to minimize their organizations’ risk.
The Red Zone Continues to Help CISOs Prioritize Patching Efforts: The analysis by FortiGuard Labs around EPSS exploitation in the wild expands upon the efforts to define the Red Zone, which helps quantify the proportion of available vulnerabilities on endpoints that are being actively attacked. In the second half of 2022, the Red Zone was around 8.9%, meaning that about 1,500 of the more than 16,500 known CVEs were observed under attack. In the first half of 2023, that number dropped slightly to 8.3%. The delta between H2 2022 and H1 2023 is minimal and would seem to be the sweet spot for malicious actors targeting vulnerabilities on endpoints. Still, it is important to note that the number of vulnerabilities discovered, present, and exploited constantly fluctuates. These variables and the effectiveness of an organization’s patch management strategy could dramatically decrease its Red Zone surface. Like the EPSS analysis above, FortiGuard Labs continues to invest in more effective ways to help organizations prioritize and more quickly close vulnerabilities.
Nearly One-Third of APT Groups Were Active in H1 2023: For the first time in the history of the Global Threat Landscape Report, FortiGuard Labs tracked the number of threat actors behind the trends. Research revealed that 41 (30%) of the 138 cyberthreat groups MITRE tracks were active in H1 2023. Of those, Turla, StrongPity, Winnti, OceanLotus, and WildNeutron were the most active based on malware detections. Given the targeted nature and relatively short-lived campaigns of APT and nation-state cyber groups compared to the long-lived and drawn-out campaigns of cybercriminals, the evolution and volume of activity in this area will be something to look forward to in future reports.
