Experts Highlight Trusted Relationships as Key Vector

In 2023, more than 1/5 of cyberattacks persisted for over a month, the annual Kaspersky Incident Response 2023 report has revealed, with trusted relationships emerging as one of the main attack vectors in these prolonged cases.

The report draws on the results of Kaspersky’s cyberattack investigations throughout the year, gathered when supporting organisations sought incident response assistance or when hosting expert events for their internal incident response teams.

Primary reasons of organisations approaching Kaspersky Incident Response team with service requests were encrypted files (32.8% of requests), suspicious activities (31%), data leakage (20%), and also included non-authorised accesses (3%), service unavailability (3%) and money theft (1.6%).

Among initial attack vectors of the investigated incidents were exploiting public facing application (42.4%), compromised accounts and BruteForce attacks (28.8% in total), trusted relationships (6.78%), phishing (5%), insider’s activity (3.4%).

Kaspersky Incident Response 2023 report indicates that long-lasting cyberattacks that persist for more than a month constituted 21.85% of the total, increasing from 2022 by 5.55%.

One notable trend observed in these attacks was the exploitation of trusted relationships as a primary vector. Compromises leveraging trusted relationships have occurred previously, but in 2023 their frequency increased.

As this method of attack enables threat actors to infiltrate multiple victims through a single compromised organisation, investigative teams face several additional challenges. Firstly, initially targeted organisations don’t always recognise the importance of thorough investigations and may be reluctant to cooperate.

Secondly, attacks initiated through trusted relationships often require more time to progress from the initial intrusion to the final incursion phase. Therefore 50% of these attacks lasted more than a month. A similar proportion of attacks exceeding one month were exclusively registered within the insider and phishing vectors.

“Our latest findings underscore the critical role of trust in cyberattacks. In 2023 and for the first time in recent years, attacks through trusted relationships were among the three most used vectors. Half of these incidents were discovered only after a data leak had been found.

“By exploiting trusted relationships, threat actors can prolong attacks and infiltrate networks for extended periods, posing significant risks to organisations. It’s imperative for businesses to remain vigilant and prioritise security measures to safeguard against such sophisticated tactics,” comments Konstantin Sapronov, Head of Global Emergency Response Team at Kaspersky.