Log4Shell shows no sign of fading, spotted in 30% of CVE exploits

Organizations continue to run insecure protocols across their wide access networks (WAN), making it easier for cybercriminals to move across networks, according to a Cato Networks survey.

Enterprises are too trusting within their networks

The Cato CTRL SASE Threat Report Q1 2024 provides insight into the security threats and their identifying network characteristics for all aggregate traffic—regardless of whether they emanate from or are destined for the internet or the WAN—and for all endpoints across sites, remote users, and cloud resources.

“As threat actors constantly introduce new tools, techniques, and procedures targeting organizations across all industries, cyber threat intelligence remains fragmented and isolated to point solutions,” said Etay Maor, Chief Security Strategist at Cato Networks.

Once threat actors penetrate a network, they usually have less of a problem snooping critical data in transit across the network. All enterprises continue to run insecure protocols across their WAN, with 62% of all web application traffic being HTTP, 54% of all traffic being telnet, and 46% of all traffic being SMB v1 or v2 instead of SMBv3.

Security varies between industries

Lateral movement (where attackers will move across networks) was identified most frequently in the agriculture, real estate, and travel and tourism industries.

The most common AI tools used among enterprises during the first three months of 2024 were Microsoft Copilot, OpenAI ChatGPT, and Emol, an application that records emotions and talks with AI robots.

The strongest adoption of these tools was seen in the travel and tourism industry (used by 79% of organizations), and the lowest adoption among entertainment organizations (44%).

Newly discovered vulnerabilities do not necessarily mean that the threats exploiting them are the most common. While zero-day threats earn much attention in the industry, threat actors often eschew the use of the latest vulnerabilities and instead exploit unpatched systems.

When evaluating the top ten inbound common vulnerabilities and exposures (CVEs), the seven-year-old attack targeting the PHPUnit testing framework (CVE-2017-9841) was the most common found and it was found across 33% of the inbound CVE exploitations observed.

Log4Shell

Furthermore, three years after its discovery, Log4Shell (CVE-2021-44228) remains one of the most used exploits and it was found across 30% of the outbound CVE exploitations observed.

Of the observed media and entertainment organizations, 48% did not use one of 200+ applications identified by Cato CTRL as information security tools. The top three industries targeted with T1499 Endpoint Denial of Service techniques are entertainment, telecommunication, and mining & metals.

In the services and hospitality sectors, threat actors utilize the T1212 Exploitation for Credential Access three times or more often than in other sectors.