Attackers Move Quickly to Exploit High-Profile Zero Days: Insights From the 2022 Unit 42 Incident Response Report
Summary: Unit 42's 2022 Incident Response Report, drawing on more than 600 cases, found software vulnerabilities were the suspected initial access vector in 31% of intrusions, second to phishing at 37%. Where responders identified the exploited vulnerability, over 87% fell into one of six CVE categories, including Log4j and Zoho ManageEngine ADSelfService Plus, and a Threat Prevention signature for the F5 BIG-IP authentication bypass (CVE-2022-1388) triggered 2,552 times within 10 hours of release.
Bottom line: Attackers can begin scanning within 15 minutes of a CVE being announced, and nearly 32% of exposed organizations were running an end-of-life Apache Web Server open to remote code execution - so the gap between disclosure and patch is now measured against an adversary that is already looking.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-41773CVE-2021-42013CVE-2022-1388
- Related
- CVE-2022-1388: F5 BIG-IP Missing Authentication Vulnerability Known Exploited Vulnerabilities · May 10, 2022