Trend analysis of ransomware attacks in the first quarter of this year reveals a continual increase in the number of "unknown" initial attack vectors, and I think I understand why.
There are two reports that you should be keeping an eye on—the updated Verizon Data Breach Report and Coveware’s Quarterly Ransomware Reports.
In Coveware's Q1 report, we see a continuing upward trend in “unknown” as the top initial attack vector.
Source: Coveware
Historically, phishing and remote access compromise (formerly reported as RDP compromise) seemed to battle for the top spot each quarter. Simultaneously, as the occurrence of "unknown" and phishing increased, remote access compromise also appeared to rise, though at a slower pace.
Then it hit me: A fair amount of “unknown” could be attributed to phishing.
Let’s address the growth in remote access compromise. The growth in the number of compromised credentials on the dark web is fueling this. And where are those credentials obtained? Phishing-based credential harvesting campaigns. So, it’s likely a material portion of the ransomware attacks attributed to remote access compromise also involve phishing.
Now let’s talk about the decline in phishing. We saw in the Verizon report that 89% of users that click a malicious link don’t report it. While organizations may find an instance or remnants of malware post-attack on an endpoint, they have no idea how it got there because users aren’t reporting their interaction with phishing emails. So, I’m going to add a bunch more to phishing – this time from “Unknown."
Finally, regarding "Unknown" itself, Coveware has commented on the attack vector's rise:
“It should be noted that while the clear attack vector may be unidentified by forensics, the initial access is typically just one of a dozen or so tactics necessary to achieve extortion level impact, often chained together (e.g., email phishing, RDP compromise, software vulnerability).”
Where does this leave organizations today?
Fortunately, not in a position of complete uncertainty. Revisiting the chart and considering the "adjusted" role of phishing, it becomes clear that the focus should still be on the three prevailing threat vectors: phishing, remote access and software vulnerabilities.
The reality is threat actors only have so many ways of gaining entry into an organization. By focusing on the three primary threat vectors, your preventative strategy becomes truly practical and impactful.
KnowBe4 empowers your workforce to make smarter security decisions every day. Over 65,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.