Malware authors leverage more attack techniques that enable lateral movement

A new study of over a half-million malware samples collected from various sources in 2022 revealed that attackers put a high value on lateral movement, incorporating more techniques that would allow them to spread through corporate networks. Several of the most prevalent tactics, as defined by the MITRE ATT&CK framework, that were identified in the dataset aid lateral movement, including three new ones that rose into the top 10.

«An increase in the prevalence of techniques being performed to conduct lateral movement highlights the importance of enhancing threat prevention and detection both at the security perimeter as well as inside networks,» researchers from cybersecurity firm Picus, said in their report.

Many years ago lateral movement used to be associated primarily with advanced persistent threats (APTs). These sophisticated groups of attackers are often associated with intelligence agencies and governments, whose primary goals are cyberespionage or sabotage. To achieve these goals these groups typically take a long time to understand the network environments they infiltrate, establish deep persistence by installing implants on multiple systems, they identify critical servers and sensitive data stores and try to extract credentials that gives them extensive access and privilege escalation.

APTs also used to operate in a targeted manner, going to specific companies from specific industries that might have the secrets their handlers are looking for. So, companies who didn’t have APTs in their threat models could focus more at blocking threats at the perimeter instead of detecting them inside their networks, which often requires advanced logging, event monitoring and active threat hunting by specialized personnel.

That all changed with the rise of manually operated ransomware groups that use groups of hackers known as «affiliates» to manually break into networks, move laterally, and gain as much access as they can over the systems — sometimes by compromising the domain controllers — before deploying the ransomware for maximum impact. These hackers-for-hire borrowed all the techniques APTs were using, including exploiting zero-day vulnerabilities, abusing existing operating system utilities and capabilities to reduce their footprint — a tactic known as living off the land — or deploying third-party tools that are commonly used by IT administrators or security teams. Given ransomware’s success, other cybercriminal groups have become adopting similar techniques, making lateral movement a challenge for organizations of all types and sizes, regardless of industry.

Malware programs now include 11 malicious actions on average

MITRE ATT&CK is a knowledge base of tactics, techniques, and procedures (TTPs) that provide a framework for cybersecurity professionals to prioritize defenses against malicious campaigns, malware and threat groups. The latest version of the framework tracks 14 tactics, 193 techniques and 401 sub-techniques, as well as 135 attack groups and 718 pieces of malicious or dual-use software.