It Takes Less Than a Day for Attackers to Reach Active Directory—Companies’ Most Critical Asset The Vast Majority of Ransomware Attacks Occur Outside of Business Hours
The Sophos 2023 Tech Leaders Report examines attacker behaviors and tools in H1 2023. Analyzing Sophos Incident Response cases, X-Ops discovered that median attacker dwell time dropped from 10 to 8 days for all attacks and to 5 days for ransomware attacks. In 2022, median dwell time decreased from 15 to 10 days.
Getting to and gaining control of the Active Directory server in the attack chain provides adversaries several advantages
John Shier, field CTO, Sophos
Sophos X-Ops found that it took on average less than a day—approximately 16 hours—for attackers to reach Active Directory (AD), one of the most critical assets for a company. AD typically manages identity and access to resources across an organization, meaning attackers can use AD to easily escalate their privileges on a system to simply log in and carry out a wide range of malicious activity.
“Attacking an organization’s Active Directory infrastructure makes sense from an offensive view. AD is usually the most powerful and privileged system in the network, providing broad access to the systems, applications, resources and data that attackers can exploit in their attacks. When an attacker controls AD, they can control the organization. The impact, escalation, and recovery overhead of an Active Directory attack is why it’s targeted,” said John Shier, field CTO, Sophos.
“Getting to and gaining control of the Active Directory server in the attack chain provides adversaries several advantages. They can linger undetected to determine their next move, and, once they’re ready to go, they can blast through a victim’s network unimpeded.
The dwell time for ransomware attacks also declined. They were the most prevalent type of attack in the IR cases analyzed, accounting for 69% of investigated cases, and the median dwell time for these attacks was just five days. In 81% of ransomware attacks, the final payload was launched outside of traditional working hours, and for those that were deployed during business hours, only five happened on a weekday.
The number of attacks detected increased as the week progressed, most notably when examining ransomware attacks. Nearly half (43%) of ransomware attacks were detected on either Friday or Saturday.
“In some ways we’ve been victims of our own success. As adoption of technologies like XDR and services such as MDR grows, so does our ability to detect attacks sooner. Lowering detection times leads to a faster response, which translates to a shorter operating window for attackers.
But, it doesn’t mean we’re collectively more secure. This is evidenced by the levelling off of non-ransomware dwell times. Attackers are still getting into our networks, and when time isn’t pressing, they tend to linger. But all the tools in the world won’t save you if you’re not watching. It takes both the right tools and continuous, proactive monitoring to ensure that criminals have a worse day than you do. This is where MDR can really close the gap between attackers and defenders, because even when you’re not watching, we are,” said Shier.
