April 6, 2018 By David Bisson 2 min read

Nearly half of organizations that suffered a “significant” digital attack fell victim to bad actors again within a year’s time, a new security trends report revealed.

According to Mandiant’s “M-Trends 2018” report, 49 percent of managed detection and response customers that remediated a large-scale attack suffered an incident from the same or a similarly motivated threat group within one year. The initial assaults consisted of data theft, credential harvesting and spear phishing, among other techniques.

Unpacking Repeat Cyberattack Trends

Mandiant admitted to not having looked at recompromise figures since it released its “M-Trends 2013” study five years ago. That report found that 38 percent of clients had suffered another attack after successful remediation.

The number of follow-up attacks were somewhat higher in 2017: 56 percent of customers weathered at least one significant attack from the same threat group or one like it. At the same time, the vast majority (86 percent) of organizations that remediated more than one significant cyberattack hosted more than one unique bad actor in their IT environment.

Some regional differences were apparent over the course of the year. Less than half of customers in the Americas and Europe, Middle East and Africa (EMEA) experienced another attack of consequence and/or multiple threat actors. By contrast, 91 percent of Asia-Pacific (APAC) clients dealt with a subsequent campaign, while 82 percent of organizations from that region suffered a significant attack from multiple groups.

The Good News and Bad News About Dwell Time

Dwell time, or the average number of days during which attackers lurked in a victim’s network prior to detection, increased across several regions in 2017, according to the report. The APAC average increased nearly three times, from 172 days to 489 days. The EMEA dwell time growth was more modest at 40 percent, from 106 days to 175 days.

Stuart McKenzie, vice president of Mandiant at FireEye, expressed disappointment in the growth of the median EMEA dwell time but noted that it’s not all bad news.

“On the positive side, we’ve seen a growing number of historic threats uncovered this year that have been active for several hundred days,” McKenzie said, as quoted by Infosecurity Magazine. “Detecting these long-lasting attacks is obviously a positive development, but it increases the dwell time statistic.”

During the same survey period, the dwell time for the Americas decreased from 99 days to 75.5 days. The average across all regions rose slightly from 99 days to 101 days.

Looking Ahead

In the report, Mandiant shared its prediction that foreign digital espionage groups will continue to prey upon U.S. companies and service providers in 2017. It also predicted that bad actors will target the software supply chain to spy on developers and software-makers over the course of the year.

More from

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today