IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Cyber criminals are spending longer inside business' networks after the initial breach

Cyber attackers' dwell time is up 36% thanks to initial access brokers and repeat exploitation of Microsoft Exchange vulnerabilities, according to Sophos

Cyber attackers are spending longer inside business systems after hacking them, a new report has revealed.

Rogue actors who do not use ransomware are spending the most time inside small businesses with the average dwell time observed to be 51 days in organisations with fewer than 250 employees. Attackers targeting larger (3,000 - 5,000 employees) organisations spend on average just 20 days inside.

The figures for ransomware criminals are much lower, with the average dwell time inside a business falling to just 15 days.

UK cyber security firm Sophos said these figures, taken from data in 2021, amount to a 36% increase in attacker dwell time compared to the previous year.

Graph showing attacks by business size

Sophos

Longer dwell times could be indicative of the increasing popularity of initial access brokers (IABs) in the cyber security landscape, the company said.

IABs are online services that are often sold on the deep web selling remote access to companies to prospective hackers and charging them according to the time spent inside the system.

Longer dwell times not only allow attackers to launch more attacks but also open up victims to attacks from multiple threat actors, Sophos said.

The company’s forensic analyses revealed instances of IABs, cryptominers, and multiple ransomware operators targeting businesses simultaneously.

Sophos said this growing trend of hackers simply paying for access rather than developing their exploits, for example, reflects the growing ‘professionalism’ of cyber attackers and is fuelling a thriving ransomware-as-a-service (RaaS) market.

Related Resource

The Total Economic Impact™ of Mimecast

Cost savings and business benefits enabled by using Mimecast with Microsoft 365

Total economic impact of Mimecast - whitepaper from MimecastFree download

“The world of cybercrime has become incredibly diverse and specialised. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. 

“In this increasingly dynamic, speciality-based cyberthreat landscape, it can be hard for organisations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralise attacks as fast as possible.”

Analysis of the anatomy of cyber attacks in graph form

Sophos

In addition to the pervasive reliance on IABs, Sophos’ analysis of cyber attacks revealed that the second of the most influential threats was the continued exploitation of the ProxyLogon and ProxyShell vulnerabilities in Microsoft Exchange servers.

Microsoft said this week that it had to delay the development of the next version of Microsoft Exchange by four years due to assigning so many experts to improve the security of the mail and calendaring service in the wake of mass exploitation last year.

Sophos said the bugs led to a significant number of incidents it saw during 2021 and that there are likely to be many related breaches of which businesses are still unaware.

The implantation of web shells and backdoors is likely to go unnoticed and the access they provide may later be sold to willing bidders in the IAB market, it said.

Other wider findings in the company’s Active Adversary Playbook report revealed that data exfiltration was far more common in ransomware incidents than in previous years, with the average time taken for actors to pull data from victims dropping from 4.28 to 1.84 days.

The trend speaks to the growing trend in ransomware of double extortion - a method which sees the victim’s systems corrupted, as well as data stolen with the threat of data leakage if the ransom isn’t paid.

Featured Resources

The COO's pocket guide to enterprise-wide intelligent automation

Automating more cross-enterprise and expert work for a better value stream for customers

Free Download

Introducing IBM Security QRadar XDR

A comprehensive open solution in a crowded and confusing space

Free Download

2021 Gartner critical capabilities for data integration tools

How to identify the right tool in support of your data management solutions

Free Download

Unified endpoint management solutions 2021-22

Analysing the UEM landscape

Free Download

Recommended

Ransomware now strikes one in 40 organisations per week, Check Point finds
ransomware

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
US government warns of increased risk of ransomware over holiday season
ransomware

US government warns of increased risk of ransomware over holiday season

24 Nov 2021

Most Popular

Samsung proposes 11 Texas semiconductor plants worth $191 billion
Hardware

Samsung proposes 11 Texas semiconductor plants worth $191 billion

21 Jul 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Should you take your password manager off the internet?
Sponsored

Should you take your password manager off the internet?

28 Jul 2022