{"id":36822,"date":"2022-09-28T20:48:40","date_gmt":"2022-09-28T17:48:40","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=36822"},"modified":"2026-03-28T01:49:43","modified_gmt":"2026-03-27T22:49:43","slug":"exploitation-of-internet-facing-applications-is-the-number-one-initial-attack-vector-for-last-year","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/exploitation-of-internet-facing-applications-is-the-number-one-initial-attack-vector-for-last-year\/","title":{"rendered":"Exploitation of internet-facing applications is the number one initial attack vector for last year \u00a0 \u00a0\u00a0"},"content":{"rendered":"\n

According to the recent Kaspersky Incident Response Analytics Report, more than half (53.6%) of cyberattacks in 2021 started with vulnerability exploitation. Other common initial attack methods included compromised accounts and malicious emails.  <\/strong><\/p>\n\n\n\n

When attackers plan their campaigns, they usually aim to find easily identifiable security issues, such as public servers with well-known vulnerabilities, poor passwords or compromised accounts. These initial access vectors have led to an\u00a0increasing number of high-severity cybersecurity incidents<\/a>.<\/p>\n\n\n\n

Analysis of anonymized data from incident response cases handled by Kaspersky Global Emergency Response Team (GERT) from all over the world proves that exploitation of public-facing applications, accessible from both the internal network and the internet, has become the most widely used initial vector to penetrate an organization\u2019s perimeter[1]<\/sup><\/a>. The share of this method as an initial attack vector has increased from 31.5% in 2020 to 53.6% in 2021, while usage of compromised accounts and malicious emails has decreased from 31.6% to 17.9%, and 23.7% to 14.3%, respectively. This change is likely tied to the vulnerabilities\u00a0discovered on Microsoft Exchange<\/a>\u00a0Servers\u00a0last year. The ubiquity of this mail service and the public availability of exploits for these vulnerabilities have resulted in many related incidents.<\/p>\n\n\n\n

Most incident response cases came from the EU (30,1%). Slightly less than a quarter of all cases were incidents from the Middle East (23.7%), and 6.5% – from Africa.\u00a0<\/p>\n\n\n\n

\"\u0643\u0627\u0633\u0628\u0631\u0633\u0643\u064a-<\/a><\/figure>\n\n\n\n

Geography of all incident responses conducted by Kaspersky in 2021<\/em><\/p>\n\n\n\n

Going into the impact of the attacks, file encryption, one of the most common ransomware types and deprives organizations of access to their data, has remained the main problem facing companies for three years in a row. In addition, the number of organizations who encountered cryptors in their network significantly increased during the observed period (from 34% in 2019 to 51.9% in 2021). Another alarming aspect is that in well over half of cases (62.5%), attackers spend more than a month inside the network before encrypting data.\u00a0<\/p>\n\n\n\n

Adversaries manage to stay unnoticed inside an infrastructure largely because of OS tools, well-known offensive tools and the use of commercial frameworks, which are involved in 40% of all incidents. After the initial penetration, attackers use legitimate tools for different purposes: PowerShell to collect data, Mimikatz to escalate privileges, PsExec to execute commands remotely or frameworks like Cobalt Strike for all stages of attack.<\/p>\n\n\n\n

\u201cOur report demonstrates that an appropriate patch management policy alone can reduce the likelihood of a successful attack by 50%. This yet again confirms the necessity of basic cybersecurity measures. At the same time, even the most thorough implementation of such measures cannot ensure an uncompromisable defense<\/em>,\u201d comments Konstantin Sapronov, Head of Global Emergency Response Team. \u201cGiven that adversaries resort to various malicious methods, the best way to protect your organization is to use tools and approaches that allow adversarial action to be noticed and stopped throughout the different stages of an attack.<\/em>\u201d <\/p>\n\n\n\n

\"\u0643\u0627\u0633\u0628\u0631\u0633\u0643\u064a-<\/a><\/figure>\n\n\n\n

To minimize the impact of an attack in case of an emergency, Kaspersky recommends the following:<\/p>\n\n\n\n