Threat Horizons: January 2023 Threat Horizons Report
In Q3 2022, analysis of data about Google Cloud customer compromises indicates that threat actors diversified their initial access vectors compared to what we saw earlier in the year. Weak passwords continued to be the most common factor at 41% of observed compromises. However, API key compromise played a role in nearly 20% of cases studied last quarter. In terms of which software was most targeted in Q3, we observed significant diversification. SSH was targeted in 26% of cases, but Jenkins and PostgreSQL were close behind at around 22% and 17%, respectively.
Increased diversification efforts by threat actors in targeting and access vectors highlights the constantly evolving threat landscape faced by organizations. In particular, the use of API compromise may suggest increased levels of automation by threat actors. While threat activity historically has dropped toward the end of Q4, the use of automation may allow actors to keep activity steady or even growing in volume into 2023.
Download the report to learn more.