Cybersecurity professionals are being bombarded with alerts outside of business hours, with hackers deliberately timing their attacks for maximum impact.
Research from Arctic Wolf shows more than half (51%) of alerts recorded by security operations teams are recorded after the majority of the business has clocked out.
Around 15% of all alerts also take place on weekends, the study found, forcing security workers to drop personal activities and respond to potential incidents.
Dan Schiappa, Arctic Wolf’s president of technology and services, said the study highlights the 24x7 nature of the profession and gives a glimpse into the challenges faced by teams.
“Today’s threat landscape is defined by round-the-clock attacks that target identity, exploit timing, and drive alert fatigue, leaving defenders to navigate increasingly complex tactics,” he said.
Hackers are biding their time
Threat actors deliberately launch attacks outside of business hours or during holiday periods to maximize their chances of success, according to Arctic Wolf.
With skeleton crews essentially holding the fort, this represents the perfect opportunity to hit enterprise hard and leave teams scrambling.
“Some of the most notorious recent cyber attacks were meticulously planned to coincide with long weekends or holidays,” the study noted.
In 2021, the Scottish Environmental Protection Agency (SEPA) gained firsthand experience in this regard, with hackers striking on Christmas Eve.
The attack, claimed by the infamous Conti ransomware group, resulted in the theft of thousands of SEPA files.
Arctic Wolf’s findings align with previous research on these tactics, with analysis from Darktrace showing 76% of ransomware attacks occurring either after hours or over the weekend.
“As reduced staff wind down and employees mentally and physically log off from the workplace, there is a decline in the speed of detection and triage within an enterprise,” the company noted.
Similar analysis from Semperis last year showed 72% of ransomware victims were attacked outside of working hours, such as during holiday periods.
Notably, among organizations with dedicated security operations centers (SOCs), around 85% reduced staffing levels by up to 50% during holidays or weekends.
A key factor behind this, the study found, lay in general staffing challenges or the associated costs with overtime wages.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- Best online cybersecurity courses
- How to choose the best cyber security vendor for your business
- The best malware removal tools
-
BreachForums founder resentenced to three years in prisonNews A US appeals court vacated his previous sentence and remanded the case for resentencing
-
Jaguar Land Rover says IT disruption set to continueNews The automotive manufacturer is still not fully operational after the recent cyber attack
-
Nearly 700,000 customers impacted after insider attack at US fintech firmNews FinWise, which provides loans on behalf of US financial services firms, revealed a former employee accessed sensitive customer information after leaving the firm.
-
How to check if you’ve been affected by Salesforce attacks – and stop hackers dead in their tracksNews The FBI has issued a fresh advisory over the threat posed to Salesforce customers by two threat groups. Here's how you can stay safe and mitigate any risks.
-
Kids hacking for kicks are causing security headaches at schoolsNews More than half of cyber incidents at schools are caused by students, with some tech-savvy pupils attempting to bypass security and network controls.
-
Mobile app security is a huge blind spot for developer teams – 93% are confident their applications are secure, but 62% reported breaches last yearNews Organizations are overconfident about their mobile app security practices, according to new research, and it’s putting enterprises and consumers alike at risk.
-
LNER warns customers to remain vigilant after personal data exposed in cyber attackNews LNER has warned customers to remain vigilant for social engineering attacks after a cyber attack on the rail operator exposed personal data.
-
Jaguar Land Rover u-turns on cyber attack containment claims, admits ‘some data has been affected’News Jaguar Land Rover (JLR) has admitted some data may have been accessed by hackers following a cyber attack which severely disrupted production.
