Kaspersky MDR analyst report for 2021

Kaspersky Managed Detection and Response (MDR) helps organizations to complement existing detection capabilities or to expand limited in-house resources to protect their infrastructure from the growing number and complexity of threats in real time. We collect telemetry from clients’ networks and analyze it using machine learning and artificial intelligence, plus human threat-hunting analysts. Kaspersky SOC investigates alerts and notifies the client if there is something bad going on, providing response actions and recommendations.

MDR in 2021 in numbers

In 2021:

• Kaspersky MDR received 414K alerts.
• 63.74% of received alerts were processed by SOC analysts, 6.67% of which were related to real incidents reported to customers via the MDR portal
• 77.4% of all incidents are related to only one alert
• 14% of incidents were high-severity, 66% medium-severity, and 20% low-severity
• The average identification time of high-severity incidents was 41.4 minutes
• 40.7% of high-severity incidents were targeted attacks; 18% were ethical offensive exercises (penetration testing, red teaming etc.)
• Most incidents were detected at the initial access (27.3%) and lateral movement (16.3%) stages
• Most often high-severity incidents were detected in IT (39%), industrial (30.2%), and financial (29.1%) organizations
• The LOL binaries most often used by attackers were cmd.exe, powershell.exe, and rundll.exe

Download the full Kaspersky Managed Detection and Response 2021 report.

Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.

Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.