Vulnerability exploitation volumes up over 50% in 2022

Driven by significant cyber security disclosures affecting supply chain dependencies, such as Log4j and Realtek, threat actors have vastly increased their use of vulnerabilities as a means to work their way inside their victims’ systems, with vulnerability exploitation attempts per customer up by 55% year on year (YoY) over the course of 2022, according to data compiled by Palo Alto Networks’ Unit 42 threat intelligence experts.

Presented in the latest edition of its Network threat trends research report, Unit 42’s data was drawn from across its parent’s portfolio of network monitoring and cloud products and services, including its next-generation firewalls, extended detection and response (XDR), and secure access service edge (SASE) offerings, as well as external feeds and sample exchanges among its peers in the industry.

Unit 42’s research team described a race between suppliers and threat actors to uncover and seal off new avenues of exploitation, which is creating a process of “constant churn” and piling pressure on end-user security teams.

Their findings tally with elements of Verizon’s annual Data breach investigations report (DBIR), which was also released this week, revealing that Log4j may potentially be the most exploited vulnerability in history.

“Attackers are using both vulnerabilities that are already disclosed and ones that are not yet disclosed – aka exploiting zero-day vulnerabilities,” the research team wrote. “We continue to find that vulnerabilities using remote code execution (RCE) techniques are being widely exploited, even ones that are several years old.

“While using old vulnerabilities might seem counterproductive, they still have significant value to attackers. In some cases, vulnerabilities discovered years ago have not been patched. This could be either because the company failed to fix the issue, or they didn’t provide the patch in a way that customers could easily find. In other cases, the product could lack a patch because the product is at the end of its supported lifespan.”

However, they argued, the weight of responsibility for fixing this problem should not just fall on the security supplier community – end-user organisations must have appropriate processes in place for remediating vulnerabilities safely and quickly, paying particular attention to acquiring, testing and applying patches, but also accounting for issues that might not immediately spring to mind, such as the network bandwidth needed to rush a patch out across a large enterprise’s entire IT estate.

Others also lack awareness of available patches, and are effectively rendering old, well-known vulnerabilities – into which category Log4j must soon fall, if it has not done so already – as dangerous as a newly discovered zero-day.

“Threat actors know these problems exist, and they continue to try these old vulnerabilities because they’re counting on organisations to fail at some point in the process of applying patches,” they said.