Hackers are using ransomware to accelerate their cyberattack timelines, which are now four times faster on average than just a year ago. According to the incident response report It was released on Tuesday by Palo Alto Networks.
AI is often used for reconnaissance, phishing and scripting, and operational execution. In the most efficient attack, the group steals data just 72 minutes after initial access.
Identity is a key element in attacks, appearing in 90% of incident response cases. Threat groups are increasingly using stolen identities and tokens to gain entry without displaying security warnings.
“Once an attacker has legitimate credentials, they’re logging in, not breaking in,” Sam Rubin, senior vice president of Unit 42 at Palo Alto Networks, told Cybersecurity Dive. “Once an attacker slips into normal traffic, it becomes very difficult for even mature defenders to detect.”
of Report is based on analysis of over 750 incident response cases Unit 42 analysts and researchers participated and worked around the world.
The report analyzed how threat groups are leveraging AI to operate at unprecedented speed and scale, carrying out simultaneous attacks, and leveraging known software flaws to track vulnerable targets before victims can take precautions.
For example, attackers are now targeting vulnerabilities within 15 minutes of CVE disclosure.
Hackers are also using AI to attempt reconnaissance and initial access to hundreds of targets simultaneously.
According to the report, the attackers Exploiting trusted integrations Launch an attack against a Software-as-a-Service application. Almost a quarter of incidents in the past year involved this type of attack.
These integrations provide legitimate privileged access, making it more difficult to defend against abuse of these trusted connections.
“This is a structural shift in supply chain risk, moving beyond vulnerable code to the exploitation of trusted links,” Rubin said.
