World's Critical Infrastructure Suffered 13 Cyber Attacks Every Second in 2023

In the last year, the world’s critical infrastructure – the medical, power, communications, waste, manufacturing, and transportation equipment that connects people and machines – has been under near-constant attack. Forescout Research – Vedere Labs recorded more than 420 million attacks between January and December 2023. That is 13 attacks per second, a 30% increase from 2022.

Forescout, a global cybersecurity provider, unveiled the global findings of recorded attacks in its Adversary Engagement Environment (AEE) in the new report, “2023 Global Threat Roundup.” The AEE is maintained by Vedere Labs, a leading global team dedicated to uncovering vulnerabilities in and threats to critical infrastructure.

Despite the formidable challenges posed by the ongoing surge in cyber-activity, there is an optimistic path forward. Elisa Costante, VP of Research at Forescout Research – Vedere Labs, highlights the potential for positive change, stating, “While it’s true that current efforts have fallen short in fully harnessing crucial technology to fortify critical assets and assess risks, there is an opportunity for improvement.”

Here are the top five insights from Forescout Research:

1. Not Yet Dormant: Log4j Dampens Software Library Exploits

Exploits against software libraries are witnessing a decline due to the waning popularity of Log4j exploits. This lull has given rise to a surge in exploits targeting network infrastructure and Internet of Things (IoT) devices.Among the IoT landscape, the spotlight falls on IP cameras, building automation systems, and network-attached storage, emerging as the most sought-after targets for malicious actors.Only 35% of exploited vulnerabilities made an appearance in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list. This divergence emphasizes the need for a proactive and comprehensive approach to cybersecurity, transcending reliance on known vulnerability databases.

2. OT Protocols Bear the Brunt

Operational Technology (OT) finds itself under relentless assault, with five key protocols bearing the brunt of persistent attacks. The primary targets include protocols used in industrial automation and power sectors, such as Modbus, subject to a staggering one-third of all attacks, closely followed by Ethernet/IP, Step7, and DNP3, each accounting for approximately 18% of the onslaught. IEC10X rounds out this list with 10% of attacks, leaving the remaining 2% distributed among various protocols, with BACnet emerging as the majority.Building automation protocols, such as BACnet, experience less frequent scans. However, the relative scarcity of scans belies an alarming trend—targeted exploits against vulnerabilities in building automation devices are more prevalent.

3. Post-Exploitation Tactics Shift

Persistence tactics mark a 50% surge from 3% in 2022, along with discovery (roughly 25%) and execution (the other roughly 25%). While most observed commands used by threat actors remain targeted at generic Linux systems, a notable trend involves specific commands executed for network operating systems found on widely used routers.

4. Malware Families Remain Strong

Malware families persist as formidable threats. The Agent Tesla Remote Access Trojan (RAT) commands a significant 16% share of observed malicious activity. Following closely are variants of the Mirai botnet, comprising 15%, and the Redline info stealer, holding its ground at 10%.Among command-and-control servers, Cobalt Strike emerges as the undisputed leader, commanding a substantial 46% share, trailed by Metasploit at 16%, and the emerging Sliver C2 at 13%. Most of these servers are in the United States, constituting 40% of the global landscape, with China and Russia following at 10% and 8%, respectively.

5. Threats Unleashed Across 163 Countries

Threat actors have cast a digital net far and wide, impacting 163 countries. The United States stands as the primary target, bearing the brunt with 168 malicious actors setting their sights on the nation. Other countries include the United Kingdom (88), Germany (77), India (72), and Japan (66).The usual suspects boast high concentrations of threat actors: China (155), Russia (88), and Iran (45), collectively representing nearly half of all identified threat groups. The crosshairs of these malicious entities are predominantly fixed on three key sectors: Government, Financial Services, and Media and Entertainment. As the primary pillars of societal infrastructure, these industries are at the forefront of cyber warfare, emphasizing the need for heightened security measures and collaborative efforts.

Costante continues, “The key lies in achieving comprehensive visibility, ensuring real-time contextual awareness of every device, whether managed or unmanaged. By doing so, large enterprises can transition from a reactive defense posture to a more proactive approach, steering clear of the futile game of security whack-a-mole. This shift towards enhanced visibility and proactive defense strategies signals a brighter outlook for critical infrastructure.” For more information, download the full report here.

Featured

  • New Gas Monkey Garage Venue Uses AI-Enhanced Video Technology

    Gas Monkey Garage, the automotive custom shop and entertainment brand founded by Richard Rawlings of Fast N’ Loud TV fame, has opened a vibrant new restaurant and bar in South Dakota, equipped with advanced, AI-enhanced video tech from IDIS Americas. Read Now

  • Data Driven, Proactive Response

    As cities face rising demands for smarter policing and faster emergency response, Real Time Crime Centers (RTCCs) are emerging as essential hubs for data-driven public safety. In this interview, two experts with deep field experience — Ross Bourgeois of New Orleans and Dean Cunningham of Axis Communications — draw on decades of operational, leadership and technology expertise to share how RTCCs are transforming public safety through innovation, interagency collaboration and a relentless focus on community impact. Read Now

  • Integration Imagination: The Future of Connected Operations

    Security teams that collaborate cross-functionally and apply imagination and creativity to envision and design their ideal integrated ecosystem will have the biggest upside to corporate security and operational benefits. Read Now

  • Smarter Access Starts with Flexibility

    Today’s workplaces are undergoing a rapid evolution, driven by hybrid work models, emerging smart technologies, and flexible work schedules. To keep pace with growing workplace demands, buildings are becoming more dynamic – capable of adapting to how people move, work, and interact in real-time. Read Now

  • Trends Keeping an Eye on Business Decisions

    Today, AI continues to transform the way data is used to make important business decisions. AI and the cloud together are redefining how video surveillance systems are being used to simulate human intelligence by combining data analysis, prediction, and process automation with minimal human intervention. Many organizations are upgrading their surveillance systems to reap the benefits of technologies like AI and cloud applications. Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.