A detailed analysis of the most prevalent Barracuda XDR detections in 2023 reveals a steady rise in high-severity attack attempts during the year. The data also shows a significant spike in such threats around November, and a lower peak in June, prime times for holidays and for online shopping.
The findings are summarized in a new Threat Spotlight. They underscore both the growing severity of cyberthreats targeting organizations, and adversarial behavior that Barracuda first reported on in 2022, namely how attackers seize the opportunity of people being away, busy, or distracted to launch more damaging and high-risk attacks.
Leading the list of attack detections are activities related to identity compromise, which enable attackers to breach an account and gain access to the corporate network, data, and more.
The detections that signpost identity abuse include suspicious logins, brute force attacks, and attackers disabling multifactor authentication. Suspicious login activity is spotted by Barracuda XDR’s features and AI-powered detection rules that identify pattern anomalies.
“Cybersecurity involves understanding attackers’ behavior as well as their tools and tactics. Our data for 2023 shows that attackers are launching more high-severity attacks overall, and especially during times when IT teams are away from the workplace or less attentive, such as during holidays, outside working hours, during the night, and at weekends,” said Merium Khalid, Director, SOC Offensive Security, Barracuda XDR. “Most attacks are trying to gain access to accounts by compromising identities. As attackers start to leverage AI tools to scale the volume, speed, and sophistication of attacks, these trends will escalate. Security teams need to ensure their security tools have the same power.”
Barracuda recommends that companies implement robust authentication and access controls (multifactor authentication at a minimum and ideally moving to Zero Trust-based measures), alongside a solid approach to patch management and data protection, with regular cybersecurity awareness training for employees.
This should ideally sit within an overall security framework of next-generation security technologies, backed by expert analysis and 24/7/365 SOC security monitoring to catch unknowns and anomalies that might otherwise slip through the net.
