Using its 2023 incident response teams telemetry, one cybersecurity firm has taken a deep dive into what makes them tick

In analyzing its incidence response data for 2023, one cybersecurity firm took a deeper look at what it termed “the longest cyberattacks”: those that had persisted for longer than one calendar month.

The data, gathered from Kaspersky’s customer base seeking incident response assistance or when hosting expert events for their internal incident response teams, showed some key trends.

First, the longest cyberattacks that persisted for more than a month constituted 21.85% of the total, an increase over that of 2022 by 5.55%. A primary vector of such long attacks had been identified in the data as “the exploitation of trusted relationships”. In 2022 data, this vector had also been a factor, but for 2023, its frequency had increased, accounting for 6.78% of the total number of the longest attacks. 

Secondly, it was noted that such long attacks gave threat actors more time to infiltrate multiple victims through a single compromised organization. Difficulties were encountered by investigative teams because initially-targeted organizations did not always recognize the importance of thorough investigations, and could have been reluctant to cooperate. 

Also, attacks initiated through the abuse of trusted relationships often required more time to progress from the initial intrusion to the final incursion phase. Furthermore, detecting them takes a lot longer because the attackers’ actions can be hard to distinguish from those of employees working for a contractor. Similarly, many of the longest attacks exceeding one month were exclusively registered within “insider” and phishing vectors.

According to Konstantin Sapronov, Head, Global Emergency Response Team, Kaspersky: “Cybersecurity threats are constantly evolving, and our latest findings underscore the critical role of trust in cyberattacks. In 2023 and for the first time in recent years, attacks through trusted relationships were among the three most used vectors. Half of these incidents were discovered only after a data leak had been found. By exploiting trusted relationships, threat actors can prolong attacks and infiltrate networks for extended periods, posing significant risks to organizations. It’s imperative for businesses to remain vigilant and prioritize security measures to safeguard against such sophisticated tactics.”