FireEye sees repeat cyber attacks rising in Indian companies

BENGALURU: Many Indian organisations are victims of targeted cyber attacks that are repetitive in nature with hi-tech, telecommunications and education being the most frequently targeted sectors, says M-trends report published by FireEye.

The latest trend in the incident responses investigated by FireEye found that 49% of customers in India and APAC, with at least one high priority breach, were successfully attacked again within a year. “India is in a difficult position. Organisations are increasingly being re-targeted and there is a certain lack of skill shortage making governments and organisations ill-equipped to handle sophisticated attacks,” said Tim Wellsmore, director for threat intelligence-APAC at FireEye.

Re-targetting or repeat data breaches is when an attacker infiltrates a system once and comes back to attack again. APAC region is the most vulnerable and is twice as likely to have experienced multiple incidents from multiple attackers, compared to those in North America.


“Based on data from the past 19 months, we found that 56% of all incidents responded by FireEye were targeted by the same or a similarly motivated attack group,” it said. The report found that at least one significant attack attempt — data theft, compromised accounts, credential harvesting and the like — affects at least 43% of all their customers.

The report also highlighted the poor incident response capabilities of companies in the APAC region. On an average, companies take more than a year to realise there has been a cyber attack.

“The median dwell time for APAC increased in 2017 to 498 days, from 172 days in 2016,” the report said. Dwell time is the no of days from first evidence of compromise that an attacker is present on a victim network before detection. With a maximum observed dwell time of 2,085 days, attackers maintain access to compromised organisations in APAC, longer than any other region. Another trend highlighted is the uptick in cyber attacks by state-sponsored Chinese hacker groups targeting IT service providers.