Verizon’s 2020 DBIR

Verizon’s 2020 DBIR is out, you can download a copy or peruse their publication online. Kaspersky was a contributor once again, and we are happy to provide generalized incident data from our unique and objective research.

We have contributed to this project and others like it for years now. This year’s ~120 page report analyses data from us and 80 other contributors from all over the world. The team provides thoughts on a mountain of breach data – “This year, we analyzed a record total of 157,525 incidents. Of those, 32,002 met our quality standards and 3,950 were confirmed data breaches”. And this year, Verizon pulled in far more data on cybercrime breaches. We include a few interesting notes here:

• 70% of reported breaches were perpetrated by external actors
• a majority of breaches do not just involve a dropped trojan
• 86% of breaches were financially motivated
• 81% of breaches were contained in days or less
• defenders are up against organized crime
• almost a third of reported breaches involved ransomware

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.