Network Attack Trends: Internet of Threats (August-October 2020)
Summary: Unit 42 researchers recorded 3,092,127 verified attack sessions and 656 unique threat triggers between August and October 2020, with 46.9% of attacks classified as code execution and 14.6% as privilege escalation. The most commonly exploited vulnerabilities of early summer 2020, CVE-2012-2311 and CVE-2012-1823, fell off the top list as new critical exploits including CVE-2020-17496 and CVE-2020-25213 emerged, and weaponized ThinkPHP vulnerabilities CVE-2018-20062 and CVE-2019-9082 became attackers' favored method.
Key Takeaway: Attackers ran roughly 500,000 HTTP directory traversal attempts in three months, 86.6% against port 80, and the largest share of attack traffic originated from the United States, followed by China and Russia. The researchers' read is that attackers prioritize exploits that are both severe and easily deployed, updating their arsenal whenever a new proof-of-concept appears.