The frequency of high-severity incidents with direct human involvement exceeded two per day in 2023, according to the Kaspersky Managed Detection and Response (MDR) team.

In the latest MDR Analyst Report, they observed this trend across all industries with financial, IT, government, and industrial sectors at the top of the list.

The annual Managed Detection and Response (MDR) Analyst Report provides information about the reported incidents, their nature, and their distribution by industry and geographic region.

It also highlights the most common tactics, techniques and tools attackers used in the past year. These results are based on analysis of MDR incidents detected by the Kaspersky Security Operations Center (SOC).

According to the report, 22.9% of all detected high-severity incidents were recorded in the government sector. IT companies came second (15.4%), closely followed by financial and industrial companies that reported 14.9% and 11.8% of incidents, respectively.

Regarding the nature of these incidents, nearly 25% of them were driven by humans. Just over 20% involved various types of ‘cyber exercises’, which had been previously classified by Kaspersky as targeted attacks but designated as ‘cyber exercises’ upon explicit confirmation by the customer.

The percentage of malware attacks resulting in serious consequences dipped slightly in 2023 compared to previous years, accounting for just over 12% of the total reported critical incidents.

This decline represents the smallest share of high severity incidents in recent years and can be attributed to the “commoditization of attacks”.

This trend reflects the widespread adoption of previously developed tools, originally designed for conducting targeted campaigns which, due to deliberate or accidental leaks, have become common. These tools are now being repurposed in attempts to implement fully automated attack scenarios.

The 2023 MDR’s report, also found that the proportion of incidents involving the detection of targeted attack artefacts, publicly available critical vulnerabilities and the use of social engineering was around 4-5%.

“In 2023, Kaspersky detected a smaller number of high-severity incidents, but observed a simultaneous increase in the number of medium and low severity ones. This redistribution of occurrences is associated with the detection of malware without visible traces of active human participation in attacks, which can be explained by the “commoditization of tools”.

However, it’s important to understand that the low number of high-severity incidents does not necessarily indicate low damage. Targeted attacks are now planned more carefull, and become more dangerous.

Therefore, we recommend the use of effective automated cybersecurity solutions managed with the help of experienced SOC analysts,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.

To enhance protection against advanced attacks, companies are advised to implement effective cybersecurity solutions and hire qualified practitioners to manage them or adopt managed security services such as Managed Detection and Response (MDR) and Incident Response.

These products cover the entire incident management cycle from threat identification to continuous protection and remediation. These services will help protect against evasive cyberattacks, investigate incidents and provide additional expertise even if a company lacks security workers.

Nigeria Data Protection Commission (NDPC), in partnership with Bill Gates and Melinda Foundation and KPMG are developing open banking frameworks in a move to deepen financial inclusion.

L-r:; Anna Wallace, Senior Programme Officer for Regulatory and Consumer Protection Technologies at the Bill & Melinda Gates Foundation,; Dr. Vincent Olatunji , national commissioner of the NDPC; and John Anyanwu, KPMG Head of Cybersecurity and Privacy,

This was the focus of discussion when Dr. Vincent Olatunji , national commissioner of the NDPC, received Anna Wallace, Senior Programme Officer for Regulatory and Consumer Protection Technologies at the Bill & Melinda Gates Foundation, and John Anyanwu, KPMG Head of Cybersecurity and Privacy, in Abuja.

The commission revealed in a statement on X (formerly Twitter) that the purpose of the meeting was to discuss open banking frameworks for Nigeria, a project coordinated by the Gates Foundation.

Open banking refers to the practice of providing third-party financial service providers with access to bank account information, transaction data, and other financial data through the use of application programming interfaces.

The meeting served as a pivotal step in recognising NDPC’s crucial role in the project, formalising engagement to ensure robust input in the areas of data protection and privacy.

NDPC emphasised the crucial role of digital identity in the financial sector as well as open banking, stressing the importance of implementing measures to safeguard digital identities to foster trust and confidence

Dr. Olatunji also addressed challenges posed by digital lending companies regarding transparency in data processing activities.

The NDPC Boss noted that the Commission was already working with other stakeholders to tackle the challenges.

He highlighted the misconception among some banks regarding the roles of a Chief Information Security Officer and a Data Protection Officer, emphasising the legal requirement for all data controllers to have a Data Protection Officer.

Passwords serve as the foundation of our digital lives, but they also serve as the gateway for cybercriminals to hack into sensitive personal information. Considering their essential function, passwords remain a prime target for increasingly sophisticated cybercriminal attacks.

Therefore, taking proactive measures to safeguard accounts and personal information is imperative.

To mark World Password Day on May 2nd – highlighting the essential role passwords play in protecting our lives online – Kaspersky experts are providing essential tips to enhance password security, ensuring that users data stays out of the hands of attackers.

Weak and simple passwords have always been an attractive target for scammers as cracking them gives criminals access to multiple types of data – personal data, financial information, medical records etc.

Kaspersky telemetry indicates more than 32 million attempts to attack users with password stealers took place in 2023, this followed more than 40 million incursions in 2022.

These alarming statistics highlight the need for users to create strong, unique and varied passwords for different accounts. This way they can mitigate the risks of cyber threats and maintain personal security online.

To enhance password security, Kaspersky experts recommend the following steps and practices:

The ‘association method’ helps create strong and memorable passwords

The association approach involves creating a password from a sequence of words or ideas that have personal significance but are not easily guessable by others. A password can be based on a favourite quote, a memorable song lyric, or a unique combination of objects. This technique generates strong passwords without requiring complex memorisation, helping to maintain security while reducing the risk of forgetting. For example, a phrase “I first visited Paris in 2008” could be transformed into a password “IfvPin2o:o8”.

Are regular passwords too boring? How about emoji?

If using the same password everywhere becomes too much and you lack the imagination to make up something new, emoji-passwords could be a non-standard and safe option. Since they are a part of the Unicode standard, it is potentially possible to use them as passwords.

One of the most significant pros is that scammers cannot brute-force emoji-passwords, since various tools and dictionaries can’t crack combinations like these. More detailed information on how to set up an emoji password and the necessary requirements is available here.

The most obvious option is not the safest one

Using common passwords or default values such as “1234”, “password” or “admin” could make personal data and accounts vulnerable to scammers, since they use automated tools to guess the correct combinations.

It may take several seconds to find the right answer and gain access to personal data. A strong and complicated password includes a mix of letters, numbers, and symbols, while avoiding personal information such as names or birthdays.

Additionally, there are online public free services that allow everyone check how strong their passwords are to mitigate possible risks.

Old, but gold: one account – one password

This practice ensures that if one account is compromised, others remain secure. By creating a unique password for each account, you minimise the damage a hacker can do if they manage to steal one.

This approach isolates security breaches and helps protect sensitive data. According to a global survey, the average user has approximately 8 accounts. Remembering even 2-3 long and complicated passwords (containing up to 15 symbols) could be impossible for the majority of users.

In this case it is both safe and useful to shift the responsibility of remembering all the passwords to a security solution, such as Kaspersky Password Manager.