Attackers strategically exploit weaknesses in popular and widely used software products requiring internet connectivity especially those from vendors with known security flaws. These vulnerabilities, ranging from minor to critical, provide entry points for diverse attackers – from nation-states to organized cybercriminals – who use both broad as well as targeted approaches.

Attackers target specific vendors and products with good reason. They focus on:

• Popular Software : Products with large user bases become high-value targets for maximizing impact (e.g., operating systems, content management systems).
• Internet-exposed software: Any software with necessary internet connectivity poses an increased risk.
• Vendors with a history of security weaknesses: This underscores the vital need for vendors to prioritize security.

Once inside a network, attackers escalate their operations. They might use tools like web shells to maintain access or move throughout the network to compromise more systems. This emphasizes the paramount importance of proactive practices like continuous threat exposure management (CTEM) for proactive risk mitigation.

Threat Actors' Favorites: Top Vendor Products Targeted in 2023