Firewall Security Company India Complete Firewall Security Solutions Provider Company in India
Zero-day vulnerabilities becoming major source of cyberattacks: Verizon – ET CISO
https://etimg.etb2bimg.com/thumb/msid-109773721,imgsize-874584,width-1200,height=765,overlay-etciso/corporate/zero-day-vulnerabilities-becoming-major-source-of-cyberattacks-verizon.jpg
Cyberattacks stemming from exploitation of vulnerabilities for accessing data have shot up by a staggering 180% in 2023 and almost tripled over the past year, a new study has revealed.
The growth is majorly fueled by the MOVEit vulnerability where hackers exploited a zero-day vulnerability in the MOVEit file-transfer software to steal sensitive medical and health information data of nearly 4 million Americans.
This also marks a decline in dependency on stolen credentials as a percentage of initial actions in data breaches, although it still remains the top category.
The big shift in cyberattack motives has happened towards extortion, Verizon Business showed in the 17th edition of its Data Breach Investigations Report 2023.
Out of all breaches in 2023, 32% involved some type of extortion technique, including ransomware. The median loss associated with financially motivated incidents involving ransomware or extortion of some kind was $46,000.
On the concerns around generative artificial intelligence (GenAI) fuelling cyberattacks, Verizon maintained that its use in criminal forums remained limited to AI-generated pornography.
“The number of mentions of GenAI terms alongside traditional attack types and vectors such as “phishing,” “malware,” “vulnerability” and “ransomware” were shockingly low, barely breaching 100 cumulative mentions over the past two years,” it said, adding that threat actors are still experimenting with GenAI tools such as “learning how to code” by known state-sponsored threat actors.
However, deepfakes are a cause of concern when it comes to frauds and spread of misinformation.
The study further showed that 68% of all breaches involved a non-malicious human element, caused by a person who either fell victim to a social engineering attack or made some type of error. 15% of breaches involved a third party, including data custodians or hosting partner infrastructures being breached and direct or indirect software supply chain issues.
The study recorded more than 30,000 incidents of data breaches with victims spanning 94 countries.
