Threat actors, frequently frustrated by improved enterprise security systems, increased their efforts to compromise credentials in 2023, according to CloudStrike’s 10th annual global threat report released Wednesday. “Threat actors are running into EDR products out there that are making it difficult for them. It’s difficult for them to bring their tools in and use them the way they used to,” CloudStrike’s Head of Counter Adversary Operations Adam Meyers said at a pre-release press session.
“We’ve seen threat actors focused on identity,” Meyers added. “They’ve been logging in as a legitimate user then laying low, staying under the radar by living off the land, using legitimate tools.” As a result, CloudStrike saw a 312% increase in the use of remote monitoring and management tools by adversaries in 2023.
“Those are tools that would likely be used by administrators or people within the environment so they’re less likely to catch attention, especially if they were deployed by a ‘legitimate’ user,” he explained. “This is the way these threat actors are trying to camouflage themselves with legitimate behavior, or things that look legitimate, and are harder to peel away.”
The emphasis on identity compromise and stealth appears to have devalued the role of malware in the threat actor’s repertoire. According to the report, malware-free attacks have increased from 40% in 2019 to 75% in 2023.
Threat actors becoming more cloud conscious
Another threat trend identified in the 61-page report is an increase in “cloud consciousness” among adversaries, with a 75% year-over-year increase in cloud intrusions. “This is not surprising,” Meyer noted. “We’ve seen more and more organizations deploying more and more cloud resources without having a cohesive or equivalent security posture for their cloud deployments as they do in their traditional enterprise deployments. Threat actors are taking advantage of that. They’re living in that uncertainty between the enterprise and the cloud, using the cloud to deploy tooling inside the enterprise.”
Financially motivated, or eCrime, adversaries are especially active in targeting cloud environments, the report noted, with 84% of cloud-conscious intrusions likely conducted by eCrime actors, compared to 16% conducted by targeted intrusion actors.
