{"id":5541,"date":"2025-02-17T05:18:49","date_gmt":"2025-02-17T05:18:49","guid":{"rendered":"https:\/\/fusionmindlabs.com\/blogs\/abuse-of-trusted-apps-up-51\/"},"modified":"2025-02-17T05:18:49","modified_gmt":"2025-02-17T05:18:49","slug":"abuse-of-trusted-apps-up-51","status":"publish","type":"post","link":"https:\/\/fusionmindlabs.com\/blogs\/abuse-of-trusted-apps-up-51\/","title":{"rendered":"Abuse of trusted apps up 51%"},"content":{"rendered":"\n
Here is a rewritten version of the content without changing its meaning, retaining the original length, and keeping proper headings and titles:<\/p>\n
\n

<\/p>\n


\n Sophos<\/a>, a leading global innovator in delivering cybersecurity<\/a> as a service, has released a comprehensive report titled \u201cThe Bite from Inside: The Sophos Active Adversary Report.\u201d This report provides an in-depth analysis of the evolving behaviors and attack techniques employed by adversaries during the first half of 2024. The data, compiled from nearly 200 incident response<\/a> (IR) cases from both the Sophos X-Ops IR team and the Sophos X-Ops Managed Detection and Response (MDR) team, reveals that attackers are increasingly exploiting trusted applications<\/a> and tools on Windows systems, commonly referred to as \u201cliving off the land<\/a>\u201d binaries, to conduct system discovery and maintain persistence. Compared to 2023, Sophos observed a 51% increase in the abuse of \u201cLiving off the Land\u201d binaries or LOLbins; since 2021, this increase has been 83%. Among the 187 unique Microsoft LOLbins detected in the first half of the year, the most frequently abused trusted application was remote desktop protocol (RDP). Notably, attackers abused RDP in 89% of the nearly 200 IR cases analyzed. This trend continues a pattern first observed in the 2023 Active Adversary report, where RDP abuse was prevalent in 90% of all IR cases investigated.<\/p>\n

The tactic of \u201cliving-off-the-land\u201d not only provides attackers with stealth but also lends a sense of legitimacy to their activities. While the abuse of certain legitimate tools might raise suspicions and trigger alerts, the exploitation of Microsoft binaries often has the opposite effect. Many of these abused Microsoft tools are integral to Windows and have legitimate uses, making it crucial for system administrators to understand their usage within their environments and identify what constitutes abuse. Without nuanced and contextual awareness of the environment, including continuous vigilance to new and developing events within the network, today’s stretched IT teams risk overlooking key threat activity that often leads to ransomware<\/a>,\u201d notes John Shier, field CTO, Sophos.<\/p>\n

In addition, the report found that despite the government’s disruption of LockBit’s main leak website and infrastructure in February, LockBit was the most frequently encountered ransomware group, accounting for approximately 21% of infections in the first half of 2024.<\/p>\n

Key Findings from the Latest Active Adversary Report:<\/strong><\/p>\n

Root Cause of Attacks:<\/strong> Compromised credentials remain the leading root cause of attacks, accounting for 39% of cases, although this represents a decline from the 56% noted in 2023.<\/p>\n

Network Breaches Dominate for MDR:<\/strong> When examining cases solely from the Sophos MDR team, network breaches were the most common incident encountered.<\/p>\n

Dwell Times Are Shorter for MDR Teams:<\/strong> For cases from the Sophos IR team, the dwell time (the time from when an attack starts to when it\u2019s detected) has remained approximately eight days. However, with MDR, the median dwell time is just one day for all types of incidents and only three days for ransomware attacks.<\/p>\n

The Most Frequently Compromised Active Directory<\/a> Servers Are Nearing End of Life:<\/strong> Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory (AD). All three of these versions are now out of mainstream Microsoft support\u2014one step before they become end-of-life (EOL) and impossible to patch without paid support from Microsoft. Furthermore, a full 21% of the AD server versions compromised were already EOL.<\/p>\n

\n