Poor patching practices and unencrypted protocols continue to haunt enterprises

Developed by Cato CTRL, the SASE leader’s cyber threat intelligence (CTI) research team, the Cato CTRL SASE Threat Report Q1 2024 provides insight into the security threats and their identifying network characteristics for all aggregate traffic—regardless of whether they emanate from or are destined for the internet or the WAN—and for all endpoints across sites, remote users, and cloud resources.

“As threat actors constantly introduce new tools, techniques, and procedures targeting organisations across all industries, cyber threat intelligence remains fragmented and isolated to point solutions,” said Etay Maor, Chief Security Strategist at Cato Networks and a founding member of Cato CTRL. “Cato CTRL is filling this gap to provide a holistic view of enterprise threats. As the global network, Cato has granular data on every traffic flow from every endpoint communicating across the Cato SASE Cloud Platform, and we’re excited to share what we’ve learned with the broader industry to spark a more secure future.”

The Cato CTRL SASE Threat Report Q1 2024 summarises findings gathered from Cato SASE Cloud Platform traffic flows across Cato customers between January and March 2024. Cato CTRL analysed 1.26 trillion network flows and blocked 21.45 billion attacks. Key findings include:

Enterprises are too trusting within their networks:

Once threat actors penetrate a network, they usually have less of a problem snooping critical data in transit across the network.

All enterprises continue to run insecure protocols across their WAN, with 62% of all web application traffic being HTTP, 54% of all traffic being telnet, and 46% of all traffic being SMB v1 or v2 instead of SMBv3.

Lateral movement—where attackers will move across networks—was identified most frequently in the agriculture, real estate, and travel and tourism industries.

AI takes the enterprise by storm:

The most common AI tools used among enterprises during the first three months of 2024 were Microsoft Copilot, OpenAI ChatGPT, and Emol, an application that records emotions and talks with AI robots.

The strongest adoption of these tools was seen in the travel and tourism industry (used by 79% of organisations), and the lowest adoption among entertainment organisations (44%).

Zero-day is the least of your problems:

Newly discovered vulnerabilities do not necessarily mean that the threats exploiting them are the most common. While zero-day threats earn much attention in the industry, threat actors often eschew the use of the latest vulnerabilities and instead exploit unpatched systems.

When evaluating the top ten inbound common vulnerabilities and exposures (CVEs), the seven-year-old attack targeting the PHPUnit testing framework (CVE-2017-9841) was the most common found and it was found across 33% of the inbound CVE exploitations observed.

Furthermore, three years after its discovery, Log4J (CVE-2021-44228) remains one of the most used exploits and it was found across 30% of the outbound CVE exploitations observed.

Many cyber threats are industry specific:

Of the observed media and entertainment organisations, 48% did not use one of 200+ applications identified by Cato CTRL as information security tools.

The top three industries targeted with T1499 Endpoint Denial of Service techniques are entertainment, telecommunication, and mining & metals.

In the services and hospitality sectors, threat actors utilise the T1212 Exploitation for Credential Access three times or more often than in other sectors.