Facebook Twitter LinkedIn RSS
    Trending
    • Anambra expands free solution WiFi access
    • Access group staff donates blood across Africa in life-saving initiative 
    • Access Bank Tanzania Honours President Samia Suluhu Hassan for Exceptional Leadership
    • Study shows investors believe AI market is on the brink of a seismic shift
    • NITRA-ALTON CNII & Sustainability Conference Rescheduled for August 7, 2025
    • Nigerians to earn 18% annual income with Luno’s Crypto Staking
    • USSD wahala reloaded: Are telcos quietly dipping into your airtime? By Elvis Eromosele
    • Gartner recognizes Sophos as 2025 leader for endpoint protection platforms
    Facebook Twitter LinkedIn
    ITPulse.com.ngITPulse.com.ng
    • News
    • Interviews
    • Blogs
    • Analysis
    • Opinion
    • Videos
    • Press Releases
    • Pictures
    • Advertise
    ITPulse.com.ngITPulse.com.ng
    Home»News»Six key findings in Sophos Active Adversary Playbook 2022
    News 4 Mins Read

    Six key findings in Sophos Active Adversary Playbook 2022

    mmBy ITPulseJune 8, 2022
    Facebook Twitter WhatsApp Pinterest LinkedIn Reddit Tumblr Email
    Sophos
    John Shier, senior security advisor at Sophos
    Share
    Facebook Twitter LinkedIn Pinterest Email

    A next-generation cybersecurity firm, Sophos has released the “Active Adversary Playbook 2022,” which detailed attacker behaviors that Sophos’ Rapid Response team saw in the wild in 2021.  In it, a 36% increase in dwell time, with a median intruder dwell time of 15 days in 2021 versus 11 days in 2020 was revealed.

    Below are the six key findings from the research work:

    • The median attacker dwells time before detection was longer for “stealth” intrusions that had not unfolded into a major attack such as ransomware, and for smaller organizations and industry sectors with fewer IT security resources. The median dwell time for organizations hit by ransomware was 11 days. For those that had been breached, but not yet affected by a major attack, such as ransomware (23% of all the incidents investigated), the median dwell time was 34 days. Organizations in the education sector or with fewer than 500 employees also had longer dwell times.
    • Longer dwell times and open entry points leave organizations vulnerable to multiple attackers. Forensic evidence uncovered instances where multiple adversaries, including IABs, ransomware gangs, cryptominers, and occasionally even multiple ransomware operators, were targeting the same organization simultaneously.
    • Despite a drop in using Remote Desktop Protocol (RDP) for external access, attackers increased their use of the tool for internal lateral movement. In 2020, attackers used RDP for external activity in 32% of the cases analyzed, but this decreased to 13% in 2021. While this shift is a welcome change and suggests organizations have improved their management of external attack surfaces, attackers are still abusing RDP for internal lateral movement. Sophos found that attackers used RDP for internal lateral movement in 82% of cases in 2021, up from 69% in 2020.
    • Common tool combinations used in attacks provide a powerful warning signal of intruder activity. For example, the incident investigations found that in 2021 PowerShell and malicious non-PowerShell scripts were seen together in 64% of cases; PowerShell and Cobalt Strike combined in 56% of cases, and PowerShell and PsExec were found in 51% of cases. The detection of such correlations can serve as an early warning of an impending attack or confirm the presence of an active attack.
    • Fifty percent of ransomware incidents involved confirmed data exfiltration – and with the available data, the mean gap between data theft and the deployment of ransomware was 4.28 days. Seventy-three percent of incidents Sophos responded to in 2021 involved ransomware. Of these ransomware incidents, 50% also involved data exfiltration. Data exfiltration is often the last stage of the attack before the release of the ransomware, and the incident investigations revealed the mean gap between them was 4.28 days and the median was 1.84 days.
    • Conti was the most prolific ransomware group seen in 2021, accounting for 18% of incidents overall. REvil ransomware accounted for one in 10 incidents, while other prevalent ransomware families included DarkSide, the RaaS behind the notorious attack on Colonial Pipeline in the U.S. and Black KingDom, one of the “new” ransomware families to appear in March 2021 in the wake of the ProxyLogon vulnerability. There were 41 different ransomware adversaries identified across the 144 incidents included in the analysis. Of these, around 28 were new groups first reported during 2021. Eighteen ransomware groups seen in incidents in 2020 had disappeared from the list in 2021.

    The report also reveals the impact of ProxyShell vulnerabilities in Microsoft Exchange, which Sophos believes some Initial Access Brokers (IABs) leveraged to breach networks and then sell that access to other attackers.

    Commenting, John Shier, senior security advisor at Sophos noted that the world of cybercrime has become incredibly diverse and specialized, adding that IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks.

    “In this increasingly dynamic, specialty-based cyberthreat landscape, it can be hard for organizations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralize attacks as fast as possible,” he said.

    Sophos’ research also shows that intruder dwell time was longer in smaller organizations’ environments. Attackers lingered for approximately 51 days in organizations with up to 250 employees, while they typically spent 20 days in organizations with 3,000 to 5,000 employees.

     

    Active Adversary Playbook 2022 Sophos
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email
    mm
    ITPulse
    • Website
    • Facebook
    • Twitter
    • LinkedIn

    ITPulse is a wholly information technology communication (ICT) news website, with a special focus on the African continent. The website provides up-to-date biz-tech news, analysis and comprehensive and thorough insight into the continent's ICT terrain

    Related Posts

    Anambra expands free solution WiFi access

    July 25, 2025

    Nigerians to earn 18% annual income with Luno’s Crypto Staking

    July 23, 2025

    Gartner recognizes Sophos as 2025 leader for endpoint protection platforms

    July 22, 2025

    Leave A Reply Cancel Reply

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    Latest Posts

    Anambra expands free solution WiFi access

    July 25, 2025

    Access group staff donates blood across Africa in life-saving initiative 

    July 25, 2025

    Access Bank Tanzania Honours President Samia Suluhu Hassan for Exceptional Leadership

    July 25, 2025
    About
    About

    Itpulse.com.ng is a wholly information technology communication (ICT) news website, with special focus on the African continent. The website provides up-to-date biz-tech news, analysis and a comprehensive and thorough insight info the continent's ICT terrain.

    Contact us: editorial@itpulse.com.ng

    Facebook Twitter LinkedIn RSS
    Latest Posts

    Anambra expands free solution WiFi access

    July 25, 2025

    Access group staff donates blood across Africa in life-saving initiative 

    July 25, 2025

    Access Bank Tanzania Honours President Samia Suluhu Hassan for Exceptional Leadership

    July 25, 2025
    Popular Posts

    Data is the new oil: Africa Data Centres Executive on digital transformation

    July 22, 2025

    Nigeria’s economy sees boost in Q1 2025, driven by surging ICT sector

    July 22, 2025

    Dr. Omoniyi Ibietan: A PR powerhouse redefining strategic communication in Africa

    July 21, 2025
    © 2017 - 2025 Itpulse. Designed by Max Excellence.
    • Terms & Conditions
    • Privacy Policy
    • Advertise
    • Contact Us

    Type above and press Enter to search. Press Esc to cancel.