Sophos released “The Bite from Inside: The Sophos Active Adversary Report.” This in-depth report looks at the changing behaviours and attack techniques that adversaries used in the first half of 2024. The data, derived from nearly 200 incident response [IR] cases from across both the Sophos X-Ops IR team and Sophos X-Ops Managed Detection and Response [MDR] team, found that attackers are leveraging trusted applications and tools on Windows systems, commonly called “living off the land” binaries, to conduct discovery on systems and maintain persistence.
Sophos observed a 51% increase in the abuse of “Living off the Land” binaries [LOLBins] compared to 2023. This was also a 83% increase since 2021.
Among the 187 unique Microsoft LOLbins detected in the first half of the year, one of the the most frequently abused trusted applications was remote desktop protocol [RDP]. Of the nearly 200 IR cases analyzed, attackers abused RDP in 89% of them.
This dominance builds on a trend first observed in the 2023 Active Adversary report. Investigators found RDP abuse in 90% of all IR cases.
“Living-off-the-land not only enhances the stealth of an attacker’s activities but also lends implicit legitimacy to their actions.” Says John Shier, field CTO at Sophos. “While some legitimate tools might trigger suspicion or alerts among defenders, abusing a Microsoft binary often has the opposite effect. Many of these Microsoft tools are essential to Windows and serve legitimate purposes. However system administrators must understand their usage in their environments and recognize signs of abuse. Without contextual and nuanced awareness of their networks, including continuous vigilance for new and evolving events. Today’s stretched IT teams risk overlooking critical threat activity that often escalates to ransomware.”
The report revealed that LockBit remained the most frequently encountered ransomware group. It accounted for approximately 21% of infections in the first half of 2024. This is despite the government disrupting its main leak website and infrastructure in February.
Other key findings from the latest Active Adversary Report:
The Most Frequently Compromised Active Directory Servers Are Nearing End of Life. Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory [AD]. All three of these versions are now out of mainstream Microsoft support—one step before they become end-of-life [EOL] and impossible to patch without paid support from Microsoft. In addition, a full 21% of the AD server versions compromised were already EOL.
Root Cause of Attacks: Continuing a trend first noted in the Active Adversary Report for Tech Leaders, compromised credentials are still the number one root cause of attacks, accounting for the root cause in 39% of cases. This is, however, a decline from the 56% noted in 2023.
Network Breaches Dominate for MDR: When examining solely the cases from the Sophos MDR team, network breaches were the dominant incident the team encountered.
Dwell Times Are Shorter for MDR Teams: For cases from the Sophos IR team, dwell time [the time from when an attack starts to when it’s detected] has remained approximately eight days. However, with MDR, the median dwell time is just one day for all types of incidents and only three days for ransomware attacks.
