IBM Report: Manufacturing the most extorted industry in 2022

IBM Security released its annual X-Force Threat Intelligence Index, finding that although ransomware's share of incidents declined only slightly from 2021 to 2022, defenders were more successful detecting and preventing ransomware. Despite this, attackers continued to innovate with the report showing the average time to complete a ransomware attack dropped from two months to less than four days. 

According to the 2023 report, the deployment of backdoors, which allow remote access to systems, emerged as the top action by attackers last year. About 67% of those backdoor cases related to ransomware attempts, where defenders were able to detect the backdoor before ransomware was deployed. The uptick in backdoor deployments can be partially attributed to their high market value. X-Force observed threat actors selling existing backdoor access for as much as $10,000, compared to stolen credit-card data, which can sell for less than $10 today.

"The shift toward detection and response has enabled defenders to disrupt adversaries earlier in the attack chain—tempering ransomware's progression in the short term," said Charles Henderson, head of IBM Security X-Force. "But it's only a matter of time before today's backdoor problem becomes tomorrow's ransomware crisis. Attackers always find new ways to evade detection. Good defense is no longer enough. To break free from the never-ending rat race with attackers, businesses must drive a proactive, threat-driven security strategy."

The IBM Security X-Force Threat Intelligence Index tracks new and existing trends and attack patterns, pulling from billions of datapoints from network and endpoint devices, incident response engagements and other sources. Some of the key findings in the 2023 report include:

• Extortion: threat actors go-to method. The most common impact from cyber-attacks in 2022 was extortion, which was primarily achieved through ransomware or business email-compromise attacks. Europe was the most targeted region for this method, representing 44% of extortion cases observed, as threat actors sought to exploit geopolitical tensions.
• Cybercriminals weaponize email conversations. Thread hijacking saw a significant rise in 2022, with attackers using compromised email accounts to reply within ongoing conversations posing as the original participant. X-Force observed the rate of monthly attempts increase by 100% compared to 2021 data.
• Legacy exploits still doing the job. The proportion of known exploits relative to vulnerabilities declined 10% from 2018 to 2022, due to the fact that the number of vulnerabilities hit another record high in 2022. The findings indicate that legacy exploits enabled older malware infections such as WannaCry and Conficker to continue to exist and spread.

The report features data IBM collected globally in 2022 to deliver insightful information about the global threat landscape and inform the security community about the threats most relevant to their organizations, per IBM. Find a copy of the report here.