2024 Attack Library Update Statistics

In today's rapidly evolving cyber threat landscape, timely and comprehensive security validation capabilities are crucial for corporate security protection. As China's leading security metrics and validation platform, our security research team continuously tracks, analyses, and reproduces global cyber attack activities, converting them into executable validation and detection rules to help customers effectively evaluate and enhance their security defence systems. This report summarises the updates to the attack library for the year 2024, fully reflecting the current cybersecurity landscape.

Key Findings

Rule Library Scale and Coverage:

Validation Rule Library: Added 5,962 validation rules, 386 validation scenarios, and 44 attack playbooks

Detection Rule Library: Added 3,126 detection rules and 41 detection scenarios

154 HVV-specific validation rules and 128 detection rules

An average weekly update of over 100 rules, ensuring timely responses to emerging threats

Major Threat Characteristics:

Ransomware activity remains highly active, with attack techniques continuously evolving (2020-2024)

Targeted attacks by APT groups (such as APT28, APT32, etc.) are more precise and persistent

Web attacks are dominated by SQL injection, while file operation-type attacks show an upward trend

Malware covers 30 categories, with 2,078 related rules

Distribution of Products Involved in Attacks:

Affecting 542 products from 364 IT vendors

Covering enterprise office collaboration, enterprise management, cybersecurity products, and infrastructure

Apache-related vulnerabilities are the most active, involving 462 CVE vulnerabilities

Domestic office software has become a key target of attacks

Security Trend Insights:

Attack methods are moving towards automation and weaponisation

Attackers are focusing more on directly obtaining control privileges

Coexistence of new and old vulnerabilities; system updates and maintenance remain key

Supply chain security risks are prominent

These findings reflect that cyber attacks are developing towards a more systematic and professional direction. Enterprises need to establish continuous security validation mechanisms, test the effectiveness of their defence systems through real attack scenarios, and optimize the key directions of security construction accordingly.

Statistics on Newly Added Validation Rules in 2024

Validation Scenarios

• Ransomware activity constitutes an important threat category, including multiple well-known ransomware families from LockBit to BlackCat. These ransomware families have not only developed specific variants for different operating systems, but their activity span has also persisted from 2020 to 2024, demonstrating the continuity and evolution of ransomware attacks.

• Advanced Persistent Threat (APT) group activities also account for a large proportion. These groups include well-known hacker organisations such as APT28, APT29, APT32, Lazarus, and Kimsuky. They launch targeted attacks against different regions and industries through cyber espionage, data theft, and supply chain attacks, showing clear strategic and targeted characteristics.

• Backdoors and Remote Access Trojans (RAT) constitute another major attack category. These tools include well-known RAT families such as DarkComet, Gh0st RAT, and PlugX. Attackers use these tools to establish persistent access channels in victim systems to achieve remote control and management of target systems.

• The application of information-stealing tools is also very common. Information stealers represented by Redline and Lumma Stealer are specifically designed to steal sensitive information such as user credentials and browser data. These tools are often highly targeted and stealthy.

• Web attack activities exhibit diverse characteristics. Attackers launch exploit attacks against widely used Web applications such as Apache, Nginx, and domestic office software, while also utilizing traditional Web attack methods like XSS. This reflects that Web application security remains an important area of protection.

• Malicious payload delivery technology continues to develop, with various loaders and droppers (such as PikaBot and Babble) widely used. These tools provide attackers with flexible malware deployment capabilities, making attacks more covert and efficient.

• Botnet activity remains active, with IoT botnets represented by Mirai and Hajime continuing to develop. These networks are not only used to launch DDoS attacks, but also provide attackers with an extensible attack platform.

• Attack tactics simulation (micro-simulation plan) covers multiple technical areas, including the simulation of attack techniques such as process injection, lateral movement, credential access, system information discovery, and DLL side-loading. These simulation scenarios help organisations better understand and respond to various attack methods.

• These malicious activity scenarios span from 2018 to 2024, not only demonstrating the diversity and complexity of cybersecurity threats, but also reflecting the continuous evolution of attack techniques and the urgency of security protection.

Attack Playbooks

The attack playbook library covers typical attack activities of numerous global threat groups, including the activities of well-known APT groups such as APT32 (OceanLotus), APT28 (Fancy Bear), and APT35, the activities of active ransomware groups like LockBit and Cl0p, and targeted attacks by threat groups like Lazarus, FIN7, and SideWinder against critical sectors such as finance, energy, and government agencies. These high-quality playbooks are based on real threat intelligence. They not only cover typical attack scenarios across different industries and regions, but also include the complete attack chain from initial access to destructive impact, helping customers evaluate and improve their security protection capabilities in all aspects. MITRE ATT&CK Mapping

Commonly Used MITRE ATT&CK Tactics and Techniques

Newly added attack techniques are mainly concentrated in the following aspects:

💡 The Initial Access (TA0001) and Execution (TA0002) phases contain a relatively large number of attack techniques, indicating that attackers have diverse technical choices in the early stages of intrusion, such as the use of PowerShell, command-line tools, etc.

💡 Key phases such as Privilege Escalation (TA0004), Defense Evasion (TA0005), and Credential Access (TA0006) also show many technical points, reflecting that attackers' techniques in obtaining and maintaining system control are constantly evolving.

💡 The technical distribution across the entire attack chain is relatively complete, with corresponding technical coverage from initial access to final data exfiltration (TA0010), demonstrating the systemic nature and completeness of current cyber attacks.

💡 Compared with traditional attack methods, many new attack techniques based on scripts and automated tools have been added, indicating that attack methods are developing towards a more automated and weaponised direction. This distribution suggests that attackers are adopting more systematic and automated methods to achieve their attack objectives.

📍 Note: Currently, the attack library of the Seccor Security Metrics and Validation Platform supports the mapping of tactics, techniques, and sub-techniques of the ATT&CK Enterprise V16 version.

WEB Category Attack Rules

Attack Type Focus

• SQL injection remains the primary attack method

• File-related operations (reading, uploading) represent the second largest attack type

• Authentication bypass and malicious attachments in phishing emails remain major threats

Key Protection Recommendations • Database security protection should be the top priority • File operation permissions need to be strictly controlled • Ingress validation and attachment detection cannot be ignored

Overall Trends • Traditional attack methods still dominate • Attack methods exhibit diverse characteristics • File-operation attacks show an upward trend This indicates that the focus of Web security protection still needs to address traditional high-risk vulnerabilities, while also guarding against diverse attack methods such as file operations. IT Vendors Involved in Attacks

The IT product categories involved in various attacks cover the complete enterprise-level informatisation product system, involving 542 products from a total of 364 IT vendors.

Mainly including enterprise office collaboration (such as Weaver, Tongda, and other OA systems), enterprise management (such as Yonyou, Kingdee, and other ERP/CRM systems), cybersecurity (such as Sangfor VPN, Venusetech gateway, and other security products), infrastructure (such as Ruijie, H3C, and other network equipment), video surveillance (such as Hikvision, Dahua, and other security platforms), open-source platforms (such as the Apache series, ThinkPHP, and other frameworks), document management (such as Esafen, etc.), and cloud computing and virtualisation (such as VMware, etc.).

TOP 10 Frequently Exploited CVE Vulnerabilities

Involving a total of 462 CVE vulnerabilities, including 46 Apache-related CVE vulnerabilities. Apache-related vulnerabilities occupy a dominant position, with the Apache Shiro and Apache Commons series of vulnerabilities being particularly prominent, reflecting that open-source component security risks remain a key focus area. Vulnerability types are mainly concentrated in high-risk categories such as remote code execution, deserialization, and authentication bypass. Once exploited, these vulnerabilities will cause severe security impacts. In addition to the Apache series, vulnerabilities also involve multiple basic platforms and systems such as Linux, Windows, and PHP, showing that the attack surface is continuously expanding, and infrastructure security likewise cannot be ignored. It is worth noting that the vulnerabilities exploited in these attack activities include not only recently discovered vulnerabilities (such as those from 2024) but also historical vulnerabilities (such as those from 2014 and 2016) that are still being used. This indicates, first, that these applications have a very high usage rate, and second, that many are still running with vulnerabilities (unpatched). Therefore, the continuous exploitation of old vulnerabilities remains a significant security issue. Overall, vulnerability exploitation is characterised by a wide scope, high severity, and strong persistence, requiring enterprises to maintain high vigilance in the use of open-source components, system updates, and maintenance. Validation of Diverse Security Products

The security products applicable for validation cover a comprehensive security protection system from network and endpoint to application, including network security protections such as NGFW (Next-Generation Firewall), IDS/IPS (Intrusion Detection and Prevention), NTA/NDR (Network Threat Analysis), and Proxy (Proxy Server); endpoint and host security protections such as AV (Antivirus), HIDS (Host-based Intrusion Detection), and EDR/XDR (Endpoint Detection and Response); as well as application security protections like WAF (Web Application Firewall) and RASP (Runtime Application Self-Protection).

From the perspective of the distribution of validation rules for the security products involved, attackers' efforts most frequently involve network boundary protection and threat detection systems, such as NGFW, IDS/IPS, NTA/NDR, and other core security products. At the same time, they are continuously attempting to break through endpoint protection and proxy monitoring, indicating that attackers are systematically searching for weak links in the defence system.

Threat Groups

Tracking 245 threat groups, with 2,143 related validation rules.

Malware

Including 30 types of malware, with a total of 2,078 related validation rules, of which ransomware-related rules reach 438.

Attack targets are shifting towards direct monetization: The dominance of ransomware and backdoor software indicates that attackers prefer methods that can directly bring economic benefits or control privileges, rather than traditional methods like botnets and cryptomining.

The attack chain exhibits completeness: From downloaders and droppers to the final malware, the data reflects a complete attack chain, indicating that current cyber attacks are developing towards a more organised and systematic direction.

Attack methods are diversified: Including multiple types such as remote access, information theft, and hacking tools, showing that attackers are continuously expanding and refining their library of attack methods.

Rise of emerging threats: Threat rules for traditional cryptomining and botnets are relatively few, indicating that cybersecurity threats are undergoing a transformation, with new attack methods replacing traditional threats.

The professionalisation of attacks has increased: The existence of various professional hacking tools and remote control tools reflects that cyber attacks are developing towards a more professional and precise direction.

Statistics on Newly Added Detection Rules in 2024

The detection scenario library covers typical techniques of major global Web attack threats (such as SQL injection, XSS, XXE, SSRF, CSRF, WebShell, and other typical attack techniques) targeting attack payloads of various IT products, including vulnerabilities from internationally renowned vendors such as Microsoft Exchange, VMware, and Cisco. It also includes core vulnerabilities of basic components such as the Apache suite (Tomcat, Struts2, Log4j, etc.) and the Spring Framework, as well as vulnerabilities from domestic IT product vendors like NSFOCUS and Venusetech, and widely used collaborative office system vulnerabilities like Weaver OA, Seeyon OA, and Tongda OA.

Detection Rule Types

Detection rules are mainly concentrated in several key areas: Injection attacks (including SQL injection, boolean injection, etc.) account for the largest proportion, among which SQL injection-related rules are the most numerous, followed by WebShell uploading and execution. Remote Code Execution (RCE) attacks also account for a large proportion, reflecting that attackers are actively looking for and exploiting remote execution vulnerabilities. In addition, traditional Web security issues such as arbitrary file reading, file uploading, Cross-Site Scripting (XSS), and deserialization still exist, but their relative number of rules is small. From the overall trend, attackers prefer to use attack methods that can directly obtain server control privileges (such as injection and RCE) rather than traditional attack methods like XSS and SSRF, indicating that the targeting and severity of attacks are increasing.

TOP 5 Frequently Exploited CVE Vulnerabilities

Involving 415 types of CVE vulnerabilities.

It is worth noting that the vulnerabilities exploited in these attack activities include not only recently discovered vulnerabilities (such as those from 2024) but also historical vulnerabilities (such as those from 2016) that are still being used. This indicates, first, that these applications have a very high usage rate, and second, that many are still running with vulnerabilities (unpatched). Therefore, the continuous exploitation of old vulnerabilities remains a significant security issue.

IT Vendors Involved in Attacks

Mainly involving office collaboration software (such as Weaver, Seeyon, and other OA systems), database systems (such as MySQL, Oracle, PostgreSQL, etc.), Web application frameworks (such as the Apache series, ThinkPHP, Spring, etc.), security products (such as Sangfor firewalls, Venusetech gateways, etc.), and various enterprise management systems (such as CRM and ERP systems related to Yonyou and Kingdee).

Compared with the attack targets of validation rules, it includes more niche products and versions, covering a wider range of application systems and infrastructure components.

▶▶▶ Please download the 2024 Annual Attack Library Update Statistics to get the full PDF report.