Monday Morning Impact – December 30

Published On: December 29, 2024Categories: Buzz

Sophos: Abuse of Trusted Applications Surges

Sophos has released an in-depth look at the changing behaviors and attack techniques that adversaries used in the first half of 2024. The UK-based cybersecurity company’s research found that attackers are leveraging trusted applications and tools on Windows systems, commonly called “living off the land” binaries, to conduct discovery on systems and maintain persistence. When compared to 2023, Sophos saw a 51% increase in abusing “Living off the Land” binaries or LOLbins. When the data set is expanded through 2021, the increase is measured at 83%.

Among the 187 unique Microsoft LOLbins detected in the first half of the year, the most frequently abused trusted application was remote desktop protocol (RDP). Of the nearly 200 IR cases analyzed, attackers abused RDP in 89% of them. This dominance continues a trend first observed in the 2023 Active Adversary report in which RDP abuse was prevalent in 90% of all IR cases investigated.

“While abusing some legitimate tools might raise a few defenders’ eyebrows, and hopefully some alerts, abusing a Microsoft binary often has the opposite effect,” said Sophos Field CTO John Shier. “Many of these abused Microsoft tools are integral to Windows and have legitimate uses, but it’s up to system administrators to understand how they are used in their environments and what constitutes abuse. Without nuanced and contextual awareness of the environment, including continuous vigilance to new and developing events within the network, today’s stretched IT teams risk missing key threat activity that often leads to ransomware.”

Among the key findings, compromised credentials are still the number one root cause of attacks, accounting for the root cause in 39% of cases. This is, however, a decline from the 56% noted in 2023. Meanwhile, dwell time (the time from when an attack starts to when it’s detected) has remained approximately eight days. However, with MDR, the median dwell time is just one day for all types of incidents and only three days for ransomware attacks. Attackers most frequently compromised the 2019, 2016, and 2012 server versions of Active Directory (AD). All three of these versions are now out of mainstream Microsoft support—one step before they become end-of-life (EOL) and impossible to patch without paid support from Microsoft. In addition, a full 21% of the AD server versions compromised were already EOL.

The data is derived from nearly 200 incident response (IR) cases from across both the Sophos X-Ops IR team and Sophos X-Ops Managed Detection and Response (MDR) team. For readers seeking additional information, the report is entitled, “The Bite from Inside: The Sophos Active Adversary Report.”

Channel Impact^®
Channel partners can go a long way towards solidifying customer relationships by building a knowledge base around widely used attack vectors such as the ones covered in the Sophos report.

IDC: Enterprise WLAN Market Grows 5.8%, Quarter-over-Quarter

The enterprise worldwide wireless local area network (WLAN) market grew 5.8% between the second and third quarters of 2024 to reach $2.5 billion, according to IDC.

The sequential growth in the third quarter follows a 12.4% increase between the first and second quarters of 2024. This continued growth indicates that the market’s supply and demand dynamics are stabilizing after two years of volatility driven largely by the drawdown of backlogged products stemming from the COVID-19-era global supply chain crisis. The enterprise WLAN market declined 1.7% on a year-over-year (YoY) basis and is down 17.5% through the first three quarters of the year compared to the elevated revenues of 2023.

The latest Wi-Fi standards are steadily gaining traction in the enterprise WLAN market. Wi-Fi 6E, which enables Wi-Fi to utilize the 6 GHz band of unlicensed spectrum, accounted for 31.7% of the dependent access point market’s revenues in the third quarter (3Q24). That’s compared to making up 20.4% of the segment’s revenues a year earlier. Wi-Fi 7 is also starting to be adopted, making up 4.9% of the dependent AP segment’s revenues, while most remaining dependent APs continue to utilize Wi-Fi 6 technology.

“The WLAN industry continues to be a dynamic market, driven by a variety of trends. Firstly, the market continues its steady march back to normalization of supply and demand dynamics by showing growth progress on a quarter-over-quarter basis,” said Brandon Butler, Senior Research Manager for Enterprise Networks. “Meanwhile, the new standards continue to make up a larger share of WLAN investments, notably Wi-Fi 6E and Wi-Fi 7, both of which extend Wi-Fi to use to the 6 GHz band.”

In the United States the enterprise WLAN market declined 3.2% YoY but increased 10.7% sequentially from 2Q24 to 3Q24. In Western Europe, the market showed modest growth, increasing 0.2% YoY and 4.2% sequentially. In Central and Eastern Europe, the market rose 0.5% YoY and 7.8% sequentially. In the Asia Pacific region, excluding Japan and China, the market declined 4.4% YoY and fell 3.5% sequentially. In the People’s Republic of China, the market declined 10.2% YoY but rose 2.2% sequentially.

Channel Impact^®
Members of the channel continue to find opportunities in the WLAN space, but are well advised to combine such offering with cutting-edge offerings that will attract new customers and secure relationships with existing ones.

Comcast Business Acquires U.S. MSP, Nitel

Comcast Business has announced an agreement to acquire Nitel from international private equity firm, Cinven.

Based in Chicago, Nitel is a network-as-a-service (NaaS) provider, specializing in managed services, connectivity solutions, and cybersecurity services to enterprise customers across the U.S.

“Nitel is a dynamic player in managed network services, and its addition to our portfolio will strengthen our capabilities in advanced network, cloud, and cybersecurity solutions,” said Edward Zimmermann, President of Comcast Business. “With Nitel, we’re poised to deliver even greater value to our customers, empowering businesses with the tools they need to succeed now and in the future.”

Claiming 6,600 clients across the country, Nitel’s customer base is generally focused on the financial services, healthcare, and education markets.

The acquisition is subject to regulatory approvals and other customary closing conditions. Financial terms were not disclosed.

Channel Impact^®
The acquisition is projected to expand Comcast Business’ presence in connectivity, global secure networking and advanced technology, while also enhancing Comcast’s ability to serve enterprise clients and recognize new growth opportunities.

Stay in the Know

Keep tabs on what’s happening in the channel and the impact it will have on the partner community by subscribing to Channel Impact communications.