CrowdStrike has released its 2024 Threat Hunting Report, highlighting the latest adversary trends, campaigns, and tactics. The report highlights a rise in nation-state and ‘eCrime’ adversaries exploiting legitimate credentials and identities to evade detection and bypass legacy security controls, as well as a rise in hands-on-keyboard intrusions, cross-domain attacks, and cloud control plane exploits.
Key findings in the report include:
North Korea-nexus adversaries pose as legitimate US employees
FAMOUS CHOLLIMA infiltrated over 100 primarily US technology companies. Leveraging falsified or stolen identity documents, malicious insiders gained employment as remote IT personnel to exfiltrate data and carry out malicious activity.
Hands-on-keyboard intrusions increase by 55%
More threat actors are engaging in hands-on-keyboard activities to blend in as legitimate users and bypass legacy security controls. 86% of all hands-on intrusions are executed by eCrime adversaries seeking financial gains. These attacks increased by 75% in healthcare and 60% in technology, which has been the most targeted sector for seven years in a row.
RMM tool abuse grows by 70%
Adversaries including CHEF SPIDER (eCrime) and STATIC KITTEN (Iran-nexus) are using legitimate remote monitoring and management (RMM) tools like ConnectWise ScreenConnect for endpoint exploitation. RMM tool exploitation accounted for 27% of all hands-on-keyboard intrusions.
Cross-domain attacks persist
Threat actors are increasingly exploiting valid credentials in order to breach cloud environments and eventually using that access to access endpoints. These attacks leave minimal footprints in each of those domains, like separate puzzle pieces, making them harder to detect.
Cloud adversaries target the control plane
Cloud-conscious adversaries like SCATTERED SPIDER (eCrime) are leveraging social engineering, policy changes, and password manager access to infiltrate cloud environments. They exploit connections between the cloud control plane and endpoints to move laterally, maintain persistence, and exfiltrate data.
