New research from content delivery network and cloud services provider Akamai Technologies Inc. finds that application and application programming interface attacks jumped 137% through 2022.

The research, “Slipping through the Security Gaps: The Rise of Application and API Attacks Against Organizations,” finds that application and API attacks are growing in both frequency and complexity as adversaries look for more innovative ways to exploit the growing attack surface.

2022 was found to be a record-breaking year for application and API attacks, with the 137% increase said to be a major concern as organizations are adopting more web applications and APIs to enhance their business and increase ease of use for customers. The report found that Local File Inclusion remains the top attack vector, with year-over-year growth of 193%.

The Akamai researchers also detail several emerging attack vectors in the research, such as Server-Side Template Injections. SSTI is a technique in which attackers abuse notable vulnerabilities such as Log4Shell, Spring4Shell and the Atlassian Confluence vulnerability and pose serious business risks as attacks can lead to remote code execution and data exfiltration.

Server-Side Request Forgery was identified as another up-and-coming attack vector that poses a substantial threat to organizations. Akamai observed a daily average of 14 million SSRF attempts against its customers’ web applications and APIs through 2022.

Broken Object Level Authorization was also identified as a growing concern. BOLA is described as a simple yet high-risk attack method that enables access to the information of other users.

Other findings in the report included attacks on the healthcare industry growing by 82% due to the adoption of “internet of medical things” in the healthcare sector, expanding the healthcare attack surface. Median attacks on the manufacturing industry grew by 76% last year due to the proliferation of internet of things connections and the massive data collected from equipment in this sector.

“As cybercriminals evaluate who provides the best return on investment based on the level of effort, the value of data, or the likelihood of paying extortion, we often see shifts in attack trends,” Rupesh Chokshi, senior vice president and general manager of application security at Akamai, said in a statement.

Image: Akamai