Cybersecurity threats were analyzed in a recent report by Comcast Business. The report pulls data from 23.5 billion cyberattacks, spanning 500 threat types and 900 infrastructure and software vulnerabilities in 2022.

The majority of breaches now originate with the users of internal and external resources. Cyberattacks used to begin with an exploit of a vulnerability in public-facing network resources that connect to applications and infrastructure within the network perimeter. Research has shown that today, approximately 67% of all breaches start with someone clicking on a seemingly safe link, which explains why adversaries begin 80-95% of all attacks with a phish.

According to the report, attackers do their homework to uncover vulnerabilities, like open ports and misconfigured systems, as evidenced by the 242 million reconnaissance scans of customer networks and assets. The top reconnaissance tools employed by adversaries include vulnerability scanners, botnets and phishing. Once inside a network, adversaries made 2.6 million attempts to modify or create new firewall rules to establish external communications for command-and-control operations and data exfiltration.

Adversaries used various methods, including remote desktop, theft and brute force attacks to steal credentials and gain unauthorized access to customer networks. Customer logs documented over 54 million attempts to exploit credentials for initial access. Additionally, bad actors capitalized on vulnerable Remote Desktop Protocol (RDP) configurations, resulting in over 185 million attempts to gain remote access. Unauthenticated users also exploited vulnerabilities in Transmission Control Protocol (TCP) and made 139 million attempts to establish connections to victim servers. Furthermore, credential-stealing malware contributed to 159 million attempts by adversaries to steal and use credentials to infiltrate compromised networks.

According to the report, the Apache Log4j vulnerability remains a significant threat due to the widespread deployment of millions of Java applications, leaving 72% of organizations vulnerable to exploits.

IT and technical service customers saw an increase in DDos attempts, making up 25% of attempts, joining education (46%), finance (14%) and healthcare (13%) as the most targeted industry segments.

Read the full report here.