Sophos, a global cybersecurity leader, has released a report revealing that LockBit has dominated incident response cases in the first half of 2024. Based on data from nearly 200 incident response cases, the report found that attackers are using “living off the land” binaries on Windows systems to conduct system discovery and maintain persistence. The report found a 51% increase in abusing these binaries compared to 2023 and an 83% increase since 2021. The most frequently abused trusted application was remote desktop protocol (RDP), with attackers utilizing it in 89% of the cases. This trend continues, a trend observed in the 2023 Active Adversary report, where RDP abuse was prevalent in 90% of all IR cases investigated.

“Living-off-the-land not only offers stealth to an attacker’s activities but also provides a tacit endorsement of their activities. While abusing some legitimate tools might raise a few defenders’ eyebrows, and hopefully some alerts, abusing a Microsoft binary often has the opposite effect. Many of these abused Microsoft tools are integral to Windows and have legitimate uses. Still, it’s up to system administrators to understand how they are used in their environments and what constitutes abuse. Without nuanced and contextual awareness of the environment, including continuous vigilance to new and developing events within the network, today’s stretched IT teams risk missing key threat activity that often leads to ransomware,” says John Shier, field CTO of Sophos.

In addition, the report found that, despite the government disruption of LockBit’s main leak website and infrastructure in February, LockBit was the most frequently encountered ransomware group, accounting for approximately 21% of infections in the first half of 2024.

Other key findings from the latest Active Adversary Report:

  • Root Cause of Attacks: Continuing a trend first noted in the Active Adversary Report for Tech Leaders, compromised credentials are still the number one root cause of attacks, accounting for the root cause in 39% of cases. This is, however, a decline from the 56% noted in 2023
  • Network Breaches Dominate for MDR: When examining solely the cases from the Sophos MDR team, network breaches were the dominant incident the team encountered
  • Dwell Times Are Shorter for MDR Teams: For cases from the Sophos IR team, dwell time (when an attack starts to when it’s detected) has remained at approximately eight days. However, with MDR, the median dwell time is just one day for all incidents and only three days for ransomware attacks.
  • The Most Frequently Compromised Active Directory Servers Are Nearing End of Life: Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory (AD). All three of these versions are now out of mainstream Microsoft support—one step before they become end-of-life (EOL) and impossible to patch without paid support from Microsoft. In addition, 21% of the compromised AD server versions were already EOL.

To learn more about attacker behaviors, tools, and techniques, read “The Bite from Inside: The Sophos Active Adversary Report” on Sophos.com.