How today’s threat actors break into companies | Kaspersky official blog
Source Kaspersky Security Blog
Description
Three real-world case studies detailing how modern threat actors breach corporate environments, along with actionable takeaways to keep your organization out of the headlines.
Impact
The impact includes enterprise-wide ransomware infections leading to data hostage situations, encryption of critical virtual environments, and permanent data destruction via wiper malware. These attacks can cause significant operational disruption, data loss, and financial damage. The exploitation of unpatched vulnerabilities and abuse of legitimate credentials enables attackers to move laterally and escalate privileges within corporate networks, increasing the scope and severity of breaches.
Defensive guidance
The vendor recommends deploying comprehensive cybersecurity strategies combining specialized software and managed services. Key mitigations include: 1) Implementing round-the-clock monitoring via managed detection and response (MDR) services to detect early-stage threats; 2) Engaging incident response teams for rapid containment and recovery; 3) Prioritizing patch management with routine vulnerability scanning and patch deployment, especially for critical public-facing applications like SAP NetWeaver, Microsoft Exchange, SharePoint, and Active Directory; 4) Conducting security audits and hardening access controls to prevent excessive privileges, particularly on infrastructure monitoring servers; 5) Leveraging compromise assessments to detect exploitation of legacy vulnerabilities. The vendor advisory does not indicate that no action is required; rather, it emphasizes proactive defense and remediation.
Summary
The Kaspersky blog post presents three detailed case studies of corporate cyberattacks investigated by their Global Emergency Response Team. The first case involved attackers gaining access through stolen local administrator credentials, escalating privileges using tools like Mimikatz and Invoke-TheHash, and deploying ransomware across the network. The second case describes a ransomware attack leveraging a monitoring server (PRTG) with excessive privileges to pivot into the network and encrypt virtual infrastructure. The third case involved exploitation of a known SAP NetWeaver vulnerability, which had a patch available for years but was not applied, allowing attackers to deploy wiper malware that irreversibly destroyed data. These incidents highlight that attackers often rely on credential theft, privilege abuse, and unpatched vulnerabilities rather than sophisticated zero-day exploits. The report stresses the importance of patch management, least privilege access, and continuous monitoring, recommending managed detection and response (MDR) and incident response services to detect and contain such attacks early.