IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Cyber criminals are spending longer inside business' networks after the initial breach

Cyber attackers' dwell time is up 36% thanks to initial access brokers and repeat exploitation of Microsoft Exchange vulnerabilities, according to Sophos

Cyber attackers are spending longer inside business systems after hacking them, a new report has revealed.

Rogue actors who do not use ransomware are spending the most time inside small businesses with the average dwell time observed to be 51 days in organisations with fewer than 250 employees. Attackers targeting larger (3,000 - 5,000 employees) organisations spend on average just 20 days inside.

The figures for ransomware criminals are much lower, with the average dwell time inside a business falling to just 15 days.

UK cyber security firm Sophos said these figures, taken from data in 2021, amount to a 36% increase in attacker dwell time compared to the previous year.

Graph showing attacks by business size

Sophos

Longer dwell times could be indicative of the increasing popularity of initial access brokers (IABs) in the cyber security landscape, the company said.

IABs are online services that are often sold on the deep web selling remote access to companies to prospective hackers and charging them according to the time spent inside the system.

Longer dwell times not only allow attackers to launch more attacks but also open up victims to attacks from multiple threat actors, Sophos said.

The company’s forensic analyses revealed instances of IABs, cryptominers, and multiple ransomware operators targeting businesses simultaneously.

Sophos said this growing trend of hackers simply paying for access rather than developing their exploits, for example, reflects the growing ‘professionalism’ of cyber attackers and is fuelling a thriving ransomware-as-a-service (RaaS) market.

Related Resource

The Total Economic Impact™ of Mimecast

Cost savings and business benefits enabled by using Mimecast with Microsoft 365

Total economic impact of Mimecast - whitepaper from MimecastFree download

“The world of cybercrime has become incredibly diverse and specialised. IABs have developed a cottage cybercrime industry by breaching a target, doing exploratory reconnaissance or installing a backdoor, and then selling the turn-key access to ransomware gangs for their own attacks,” said John Shier, senior security advisor at Sophos. 

“In this increasingly dynamic, speciality-based cyberthreat landscape, it can be hard for organisations to keep up with the ever-changing tools and approaches attackers use. It is vital that defenders understand what to look for at every stage of the attack chain, so they can detect and neutralise attacks as fast as possible.”

Analysis of the anatomy of cyber attacks in graph form

Sophos

In addition to the pervasive reliance on IABs, Sophos’ analysis of cyber attacks revealed that the second of the most influential threats was the continued exploitation of the ProxyLogon and ProxyShell vulnerabilities in Microsoft Exchange servers.

Microsoft said this week that it had to delay the development of the next version of Microsoft Exchange by four years due to assigning so many experts to improve the security of the mail and calendaring service in the wake of mass exploitation last year.

Sophos said the bugs led to a significant number of incidents it saw during 2021 and that there are likely to be many related breaches of which businesses are still unaware.

The implantation of web shells and backdoors is likely to go unnoticed and the access they provide may later be sold to willing bidders in the IAB market, it said.

Other wider findings in the company’s Active Adversary Playbook report revealed that data exfiltration was far more common in ransomware incidents than in previous years, with the average time taken for actors to pull data from victims dropping from 4.28 to 1.84 days.

The trend speaks to the growing trend in ransomware of double extortion - a method which sees the victim’s systems corrupted, as well as data stolen with the threat of data leakage if the ransom isn’t paid.

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT
ransomware

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022
Sabbath hackers are targeting US schools and hospitals
ransomware

Sabbath hackers are targeting US schools and hospitals

29 Nov 2021
Out-of-hours ransomware attacks have a greater impact on revenue
ransomware

Out-of-hours ransomware attacks have a greater impact on revenue

18 Nov 2021
US and Israel join forces to fight ransomware
ransomware

US and Israel join forces to fight ransomware

15 Nov 2021

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The UK's best cities for tech workers in 2022
Business strategy

The UK's best cities for tech workers in 2022

24 Jun 2022
LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022