Huntress Report Finds Malware-Free Intrusions and RMM Abuse Targeting SMBs
Summary
Huntress’ Q3 2023 report, based on 2.4 million endpoints and over 1 million Microsoft 365 user entities, highlights malware-free intrusions, RMM abuse, malicious inbox rules, and diverse ransomware affecting SMBs.
Key points
- Huntress says 56% of observed Q3 2023 incidents were malware-free, with attackers using legitimate tools or scripting frameworks.
- Living-off-the-land binaries appeared in 29% of incidents, and scripting framework abuse in 27%.
- RMM and remote-control tools were hijacked for persistence or remote access in 65% of incidents.
- Malicious forwarding or inbox rules accounted for 64% of observed Microsoft 365 incidents; 24% involved logons from unusual or suspicious locations.
- LockBit appeared in 25% of observed ransomware incidents, while unknown, uncategorized, or defunct strains accounted for 60%.
- The report recommends moving beyond signature-based detection toward behavioral analysis and anomaly detection, and improving visibility into identity-based activity.
Article Details
- Publisher
- Huntress
- Report Period
- Q3 2023
- Scope
- SMB threats observed by Huntress, including endpoint and Microsoft 365 activity
- Sample Size
- Data collected from 2.4 million endpoints and over 1 million Microsoft 365 user entities under Huntress' purview
- Key Statistics
- 56% of incidents in Q3 2023 were described as essentially malware-free.
- LOLBin use was observed in 29% of incidents; scripting framework abuse in 27%.
- RMM and remote control tools were hijacked for persistence or remote access in 65% of incidents.
- Malicious forwarding or other inbox rules accounted for 64% of observed Microsoft 365 incidents; 24% involved logons from unusual or suspicious locations.
- LockBit was present in 25% of observed ransomware incidents; unknown, uncategorized, or defunct strains accounted for 60%.
- Recommendations
- Shift from signature-based detection toward behavioral analysis and anomaly detection.
- Expand security visibility beyond traditional network perimeters to include identity-based actions.
- Do not underestimate ransomware risk based on a strain's notoriety.