World's Critical Infrastructure Suffered 13 Cyber Attacks Every Second in 2023

In the last year, the world’s critical infrastructure – the medical, power, communications, waste, manufacturing, and transportation equipment that connects people and machines – has been under near-constant attack. Forescout Research – Vedere Labs recorded more than 420 million attacks between January and December 2023. That is 13 attacks per second, a 30% increase from 2022.

Forescout, a global cybersecurity provider, unveiled the global findings of recorded attacks in its Adversary Engagement Environment (AEE) in the new report, “2023 Global Threat Roundup.” The AEE is maintained by Vedere Labs, a leading global team dedicated to uncovering vulnerabilities in and threats to critical infrastructure.

Despite the formidable challenges posed by the ongoing surge in cyber-activity, there is an optimistic path forward. Elisa Costante, VP of Research at Forescout Research – Vedere Labs, highlights the potential for positive change, stating, “While it’s true that current efforts have fallen short in fully harnessing crucial technology to fortify critical assets and assess risks, there is an opportunity for improvement.”

Here are the top five insights from Forescout Research:

1. Not Yet Dormant: Log4j Dampens Software Library Exploits

Exploits against software libraries are witnessing a decline due to the waning popularity of Log4j exploits. This lull has given rise to a surge in exploits targeting network infrastructure and Internet of Things (IoT) devices.Among the IoT landscape, the spotlight falls on IP cameras, building automation systems, and network-attached storage, emerging as the most sought-after targets for malicious actors.Only 35% of exploited vulnerabilities made an appearance in the Cybersecurity and Infrastructure Security Agency’s (CISA) Known Exploited Vulnerabilities (KEV) list. This divergence emphasizes the need for a proactive and comprehensive approach to cybersecurity, transcending reliance on known vulnerability databases.

2. OT Protocols Bear the Brunt

Operational Technology (OT) finds itself under relentless assault, with five key protocols bearing the brunt of persistent attacks. The primary targets include protocols used in industrial automation and power sectors, such as Modbus, subject to a staggering one-third of all attacks, closely followed by Ethernet/IP, Step7, and DNP3, each accounting for approximately 18% of the onslaught. IEC10X rounds out this list with 10% of attacks, leaving the remaining 2% distributed among various protocols, with BACnet emerging as the majority.Building automation protocols, such as BACnet, experience less frequent scans. However, the relative scarcity of scans belies an alarming trend—targeted exploits against vulnerabilities in building automation devices are more prevalent.

3. Post-Exploitation Tactics Shift

Persistence tactics mark a 50% surge from 3% in 2022, along with discovery (roughly 25%) and execution (the other roughly 25%). While most observed commands used by threat actors remain targeted at generic Linux systems, a notable trend involves specific commands executed for network operating systems found on widely used routers.

4. Malware Families Remain Strong

Malware families persist as formidable threats. The Agent Tesla Remote Access Trojan (RAT) commands a significant 16% share of observed malicious activity. Following closely are variants of the Mirai botnet, comprising 15%, and the Redline info stealer, holding its ground at 10%.Among command-and-control servers, Cobalt Strike emerges as the undisputed leader, commanding a substantial 46% share, trailed by Metasploit at 16%, and the emerging Sliver C2 at 13%. Most of these servers are in the United States, constituting 40% of the global landscape, with China and Russia following at 10% and 8%, respectively.

5. Threats Unleashed Across 163 Countries

Threat actors have cast a digital net far and wide, impacting 163 countries. The United States stands as the primary target, bearing the brunt with 168 malicious actors setting their sights on the nation. Other countries include the United Kingdom (88), Germany (77), India (72), and Japan (66).The usual suspects boast high concentrations of threat actors: China (155), Russia (88), and Iran (45), collectively representing nearly half of all identified threat groups. The crosshairs of these malicious entities are predominantly fixed on three key sectors: Government, Financial Services, and Media and Entertainment. As the primary pillars of societal infrastructure, these industries are at the forefront of cyber warfare, emphasizing the need for heightened security measures and collaborative efforts.

Costante continues, “The key lies in achieving comprehensive visibility, ensuring real-time contextual awareness of every device, whether managed or unmanaged. By doing so, large enterprises can transition from a reactive defense posture to a more proactive approach, steering clear of the futile game of security whack-a-mole. This shift towards enhanced visibility and proactive defense strategies signals a brighter outlook for critical infrastructure.” For more information, download the full report here.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Busy South Africa Building Integrates Custom Access Control System

    Nicol Corner, based in Bedfordview, Johannesburg, South Africa, is home to a six-star fitness club, prime office space, and an award-winning rooftop restaurant. This is the first building in South Africa to have its glass façade fully incorporate fritted glazing, saving 35% on energy consumption. Nicol Corner (Pty) LTD has developed a landmark with sophisticated design and unique architecture by collaborating with industry-leading partners and specifying world-class equipment throughout the project. This includes installing a high-spec, bespoke security and access control system. Read Now

  • Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

Featured Cybersecurity

Webinars

New Products

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3