2024 Unit 42 Incident Response Report: Navigating the Shift in Cybersecurity Threat Tactics
Summary: Unit 42's 2024 Incident Response Report, drawing on data from more than 250 organizations and more than 600 incidents, found that large-scale exploitation of internet-facing vulnerabilities was the initial access vector in 39% of cases, up from 28% in 2022. Threat actors took data indiscriminately in 93% of incidents, up from 81% in 2022 and 67% in 2021, with many exfiltrating as much as they could find and sorting it out later.
What you should know: Indiscriminate data theft rose from 67% of incidents in 2021 to 93% in the report's cases, meaning attackers are now taking bulk data and finding the valuable parts afterward rather than targeting specific records. With internet-facing vulnerability exploitation as the entry point in 39% of cases, the exposed systems and unpatched software on your perimeter are the stake.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026