Advancing UK Aerospace, Defence, Security & Space Solutions Worldwide
  • Home
  • /
  • Security
  • /
  • Darktrace releases Half-Year Threat Report 2024

Security

Darktrace releases Half-Year Threat Report 2024

Cambridge based Darktrace has today released its First 6: Half-Year Threat Report 2024, identifying key threats and attack methods facing businesses across the first half of 2024.

Above: Click to download First 6: Half-Year Threat Report 2024.
Courtesy Dark Trace

These insights, observed by Darktrace's Threat Research team using its unique Self-Learning AI across its customer fleet, shed light on the persistent nature of cyber threats and new techniques adopted by attackers attempting to sidestep traditional defences.

Advertisement
ODU RT

"The threat landscape continues to evolve, but new threats often build upon old foundations rather than replacing them. While we have observed the emergence of new malware families, many attacks are carried out by the usual suspects that we have seen over the last few years, still utilizing familiar techniques and malware variants," comments Nathaniel Jones, Director of Strategic Threat and Engagement at Darktrace. "The persistence of MaaS/RaaS service models alongside the emergence of newer threats like Qilin ransomware underscores the continued need for adaptive, machine learning powered, security measures that can keep pace with a rapidly evolving threat landscape."

Cybercrime-as-a-Service continues to pose significant risk for organisations
The findings show that cybercrime-as-a-service continues to dominate the threat landscape, with Malware-as-a-Service (MaaS) and Ransomware-as-a-Service (RaaS) tools making up a significant portion of malicious tools in use by attackers. Cybercrime-as-a-Service groups, such as Lockbit and Black Basta, provide attackers with everything from pre-made malware to templates for phishing emails, lowering the barrier to entry for cybercriminals with limited technical knowledge.

The most common threats Darktrace observed from January to June 2024 were:

  1. Information-stealing malware (29% of early triaged investigations)
  2. Trojans (15% of investigated threats)
  3. Remote Access Trojans (RATs) (12% of investigated threats)
  4. Botnets (6% of investigated threats)
  5. Loaders (6% of investigated threats)

The report also reveals the emergence of new threats alongside persistent ones. Notably, the rise of Qilin ransomware, which employs refined tactics such as rebooting infected machines in safe mode to bypass security tools and making it more difficult for human security teams to react quickly.

Advertisement
ODU RT

Per the report, double extortion methods are now prevalent amongst ransomware strains. As ransomware continues to be a top security concern for organizations, Darktrace's Threat Research Team has identified three predominant ransomware strains impacting customers: Akira, Lockbit and Black Basta. All three have been observed using double extortion methods.

Email phishing and sophisticated evasion tactics rise
Phishing remains a significant threat to organizations. Darktrace detected 17.8 million phishing emails across its customer fleet between December 21, 2023, and July 5, 2024. Alarmingly, 62% of these emails successfully bypassed Domain-based Message Authentication, Reporting, and Conformance (DMARC) verification checks which are industry protocols designed to protect email domains from unauthorized use, and 56% passed through all existing security layers.

The report highlights how cybercriminals are embracing more sophisticated tactics, techniques and procedures (TTPs) designed to evade traditional security parameters. Darktrace observed an increase in attackers leveraging popular, legitimate third-party services and sites, such as Dropbox and Slack, in their operations to blend in with normal network traffic. Additionally, there's been a spike in the use of covert command and control (C2) mechanisms, including remote monitoring and management (RMM) tools, tunneling, and proxy services.

Edge infrastructure compromise and exploitation of critical vulnerabilities are top concerns
Darktrace observed an increase in mass-exploitation of vulnerabilities in edge infrastructure devices, particularly those related to Ivanti Connect Secure, JetBrains TeamCity, FortiClient Enterprise Management Server, and Palo Alto Networks PAN-OS. These compromises often serve as a springboard for further malicious activities.

It is imperative that organizations do not lose sight of existing attack trends and CVEs – cybercriminals may resort to previous, predominately dormant methods to trick organizations. Between January and June, in 40% of cases investigated by the Threat Research team, attackers exploited Common Vulnerabilities and Exposures (CVEs).

For more in-depth analysis, download the First 6: Half-Year Threat Report 2024 at www.darktrace.com/resources/first-6-half-year-threat-report-2024.

Advertisement
PTC PTC
NW PRO wins ADS Security Innovation Award

Security Events

NW PRO wins ADS Security Innovation Award

12 March 2025

NW Pro have been announced as the winners of the ADS Security Innovation Award during the Home Office’s Security and Policing Exhibition for their product NexuSec.

NPAS orders seven Airbus H135s

Aerospace Security

NPAS orders seven Airbus H135s

12 March 2025

The UK’s National Police Air Service (NPAS) has selected Airbus Helicopters to supply seven H135 helicopters as the initial phase of its fleet renewal programme.

ADS releases its Security and Resilience Outlook 2025

Security

ADS releases its Security and Resilience Outlook 2025

11 March 2025

The latest data from ADS highlights that turnover in the Security and Resilience Sector reached £24 billion in 2024, representing growth of 176% from a decade earlier.

SIA consults on proposed licence applications criteria

Security

SIA consults on proposed licence applications criteria

11 March 2025

The Security Industry Authority (SIA) has today launched a consultation on changes it is proposing to make to its licensing criteria.

Advertisement
ODU RT
HMP Highpoint expanded to create UK

Security

HMP Highpoint expanded to create UK's largest public sector jail

10 March 2025

More dangerous criminals will be taken off the streets thanks to a 700-place expansion which will turn a Suffolk jail into the UK’s largest public sector prison.

AAUK relaunches APPGAA for Air Ambulances

Aerospace Security

AAUK relaunches APPGAA for Air Ambulances

7 March 2025

Air Ambulances UK (AAUK) has relaunched the All-Party Parliamentary Group on Air Ambulances (APPGAA), reaffirming its commitment to advocating for the lifesaving work of air ambulance charities across the UK.

Advertisement
ODU RT