Global Incident Response Threat Report 2022

For today’s incident responders, combating the ceaseless wave of cyberattacks can feel like being adrift at sea during a never-ending storm. VMware’s 2022 Global Incident Response Threat Report takes a deep dive into the headwinds faced by defenders and how security teams attempt to stay the course.

In our annual survey of 125 cybersecurity and incident response (IR) professionals, we found that security teams are still reeling from pandemic disruptions and burnout while bracing for cyberattacks tied to Russia’s invasion of Ukraine.

Sixty-five percent of respondents said cyberattacks have increased since Russia invaded Ukraine. In February, for instance, we saw a new type of malware (coined HermeticWiper) deployed in one of the largest targeted attacks in history focused solely on the destruction of critical information and resources. This is part of a growing list of destructive malware deployed against Ukraine, as noted in a joint advisory the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released this spring.

Zero-day exploits also show no signs of abatement after record levels last year: 62 percent of respondents said they experienced such attacks in the past 12 months, up from 51 percent in 2021. This surge can be attributed to geopolitical conflict, too.

“Zero-days are expensive to make—and once they’re used, they’re not as useful again,” says Rick McElroy, principal cybersecurity strategist at VMware. “Nationstates are therefore prime drivers behind the zero-day market, particularly during saber-rattling moments like this.”

This year’s report delves into a number of other threat areas, including the mounting risks posed by deepfakes, container and cloud vulnerabilities, API security systems, business email compromises (BECs), and extortionary ransomware attacks. The ability of threat actors to move around networks, evade security teams, and leverage these various platforms and attack methods to further penetrate networks and distribute attacks only exacerbates these risks…