Threat Brief: Modern Initial Access Patterns

Bottom line

Exploitation of vulnerabilities is now the most common way into an enterprise in the two largest public datasets, and the gap between initial access and the next attacker taking over has shrunk to seconds. The practical result is that exposure time on internet-facing systems matters more than it did, and that detection has to start at the first foothold, not at the ransomware stage.

Key judgments

• Exploitation leads. Verizon’s Data Breach Investigations Report puts vulnerability exploitation at 31% of initial access, the first time it has led the report’s history. Mandiant’s M-Trends puts exploits at 32% of initial infection vectors in its investigations. Confidence: high that exploitation leads in both. The two figures measure different populations and should not be merged.

• People-led access has changed shape, not disappeared. In the Verizon data, phishing accounts for 16% of breaches and credential abuse for 13%. In M-Trends, stolen credentials are 9% overall, and email phishing has fallen from 22% to 6% over three reporting periods. In cloud intrusions, voice phishing is the largest single vector at 23%.

• Access is handed off almost instantly. M-Trends reports a median of 22 seconds between initial access and handoff to a secondary threat group, down from more than eight hours a few reporting periods earlier. Mandiant links this to closer cooperation between access brokers and follow-on groups, sometimes through automated malware delivery.

• Patching is not keeping pace. Verizon reports that full remediation of Known Exploited Vulnerabilities fell from 38% to 26%, and median time to full remediation rose from 32 to 43 days. Confidence: moderate to high, as the figures are cited here from press coverage of the report.

• Environment decides the pattern. On-premises and edge systems are mostly entered through exploits. Cloud and SaaS environments are mostly entered through identity: voice phishing, third parties and stolen credentials. Exploits account for 6% of cloud intrusions in M-Trends.

The patterns, with the evidence behind each

Reading the numbers correctly

The Verizon report analyses data on more than 22,000 breaches contributed by many organizations. M-Trends draws on Mandiant incident response engagements. One counts breaches wherever they were reported. The other counts cases where an organization called an incident responder. Both lean towards incidents that were serious enough to be investigated, and neither is a sample of all attacks.

A 31% share and a 32% share are close enough to support one conclusion: exploitation is at the top. They are not close enough to support a claim about a precise proportion. The credential figures differ more because the two reports classify vectors differently. Verizon separates credential abuse and phishing as distinct categories. M-Trends reports stolen credentials, phishing and prior compromise as its own set. Treat the rankings as more reliable than the percentages.

What a 22-second handoff changes

For a decade, response plans assumed a gap. The first intruder entered, spent days establishing access and looking around, and the destructive stage came later. That gap was where detection was supposed to win. M-Trends shows the median handoff from the first actor to the next now measured in seconds, and median dwell time across all investigations has risen to 14 days, from 11 and 10 in the two prior reporting periods.

Those two facts fit together. Initial access is increasingly a commodity step performed by one actor and sold or passed to another. The group that deploys ransomware or steals data can be a different group, working from access that was prepared for it. By the time defenders see the destructive activity, the evidence of how access was obtained can be several parties and several weeks old.

Two consequences follow. Controls must reduce the number of successful first footholds, because there is little time to catch up after one. And investigations must assume the first foothold is not the actor you are now fighting.

What to change

Hypotheses for hunting and detection engineering

• New MFA methods or password resets on privileged or high-value accounts within hours of a help desk contact.

• Unexpected shells or scripting processes spawned by web server or edge appliance processes.

• Remote access tools executing from user profile folders by users outside IT.

• Successful logons to cloud applications from consumer proxy networks followed by mailbox rules, token grants or bulk data queries.

• Supplier accounts active outside agreed hours or touching systems outside their normal scope.

Gaps and limits

Neither report says how many intrusions go entirely undetected. Both skew towards organizations with investigation capability. Vendor figures reported by the press can lose scope in translation, and this brief has not verified the Verizon patching and RMM figures against the full report. The vectors named here describe what was most common, which is a different question from what is most dangerous for any one organization.

Next step

Compare the pattern table with your own last twelve months of incidents and near misses, and check which row you could not have detected at the first foothold. That row is where detection engineering and hunting effort should go first.

Sources

1. Mandiant (Google Cloud). M-Trends report (latest edition), executive edition; findings also reported by SecurityWeek: “M-Trends: Initial access handoff shrinks from hours to 22 seconds.” securityweek.com

2. Verizon. Data Breach Investigations Report (latest edition), headline findings page. verizon.com

3. SC Media. “Verizon DBIR: vulnerability exploits top initial access as patching coverage falls.” scworld.com

4. CISA, FBI and international partners. Scattered Spider cybersecurity advisory (joint advisory, updated edition). ic3.gov