Learning from Incident Response Q2 2023

This technical report discusses findings from the Secureworks Counter Threat Unit (CTU) regarding incident responses conducted between April and June 2023. The analysis offers a comprehensive view of emerging threats and trends identified during reactive incident response engagements. The motivation for these engagements varies based on organizational circumstances, including internal resources and external media influences. The report details specific trends observed, such as a notable increase in ransomware incidents, which rose to 14% of engagements, up from 6% in the first quarter of 2023. It also highlights initial access vectors, including phishing and vulnerabilities in internet-facing devices. The report includes case studies illustrating specific incidents, showcasing how attackers exploited various tactics to breach networks. The information aims to assist organizations in understanding threat behaviors and improving their risk management strategies. Overall, the report serves as a vital resource for organizations aiming to enhance their incident response capabilities and resilience against evolving cyber threats.