Unit 42 highlights the need for a comprehensive security strategy that spans every IT zone. Explore the full details here.

The post Essential Data Sources for Detection Beyond the Endpoint appeared first on Unit 42.

Over the past twelve months, SentinelLABS research revealed how threat actors have changed their operational approach in ways previously unseen. Among our many research publications during 2025, we exposed North Korean threat actors monitoring the same cyber threat intelligence platforms defenders use to share indicators of compromise, and revealed how a single cryptocurrency phishing operation deployed over 38,000 malicious subdomains across trusted free-tier platforms.

2025 also saw artificial intelligence transition from theoretical threat to practical reality, though not in the revolutionary ways many predicted. Instead, AI emerged as a force multiplier, with threat actors weaponizing large language models to scale attacks, generate convincing social engineering content, and automate previously manual processes.

These discoveries and others we will explore in this review, exemplify how adversaries have fundamentally changed their operational calculus, treating legitimate infrastructure—from Telegram to free-tier publishing platforms to commercial AI APIs—as essential criminal resources and actively surveilling the defender community’s intelligence-sharing mechanisms.

Throughout 2025, SentinelLABS tracked, identified, and disclosed information on these and other critical issues to help organizations and defenders stay ahead of threats to their business operations.

All our research and threat intelligence posts can be found on the SentinelLABS home page, but for a recap of the year’s main cybersecurity events, take a scroll through the main highlights below.

Key Trends from SentinelLABS Research in 2025

• AI Weaponization Across the Threat Spectrum: Artificial intelligence matured from a theoretical threat to an operational accelerator, used to automate existing capabilities from runtime code generation (MalTerminal) to CAPTCHA bypassing (AkiraBot), lowering barriers for both sophisticated and commodity attacks.

• Threat Actors Monitoring Defensive Intelligence: North Korean operators (Contagious Interview) began actively monitoring platforms like Validin and VirusTotal to detect their own infrastructure exposure in near real-time.

• Industrial-Scale Cryptocurrency & Credentials Theft: Highly organized, business-like criminal operations such as  FreeDrain and PXA Stealer prove cryptocurrency and credential theft at scale has evolved into a professional sector with sophisticated infrastructure and monetization pipelines.

• Ransomware’s Relentless Business Model Evolution: The ransomware ecosystem saw innovations like DragonForce’s “white-label” branding service, the convergence of hacktivist and profit motivations, and the blurring of distinct ransomware families (HellCat/Morpheus deploying identical code). 

• Exploitation of Legitimate Platforms: Threat actors have increasingly leveraged trusted infrastructure for malicious purposes: Telegram for C2 and data monetization, free-tier publishing platforms for phishing campaigns, and cloud services for hosting and evasion. 

• China’s Hidden Offensive Capabilities: Research into Hafnium-linked companies and firms that provide Censorship as a Service to government customers reveal deep integration between China’s private cybersecurity sector and state offensive operations.

• Developments in Social Engineering: Through ClickFix techniques, fake CAPTCHA pages, and increasingly convincing fake job offers, threat actors have found new ways to exploit user psychology to deliver malware.

January

SentinelLABS researchers uncovered how HellCat and Morpheus ransomware operations were essentially two distinct brands deploying identical ransomware payloads, illustrating the commoditization and rebranding practices within the RaaS ecosystem. This discovery highlighted how affiliates could rebrand the same underlying malware to create the appearance of distinct threat groups, complicating attribution efforts.

Our research into a returning phishing campaign revealed the targeting of high-profile accounts on X (formerly Twitter) to promote cryptocurrency scams. The attacks demonstrated the persistent value of compromising social media accounts with large followings for financially motivated threat actors seeking to reach broad audiences with investment fraud schemes.

Key Takeaway: Understanding how common code is sourced and shared across ransomware groups can inform detection efforts and improve threat intelligence on their operations.

February

In early February, SentinelLABS reported on further variants of the FlexibleFerret DPRK malware family, continuing the Contagious Interview campaign that had been active since November 2023. The research uncovered new infection vectors and samples while also documenting persistent attempts to compromise developers through fake GitHub issues promoting malicious installer scripts.

Later in the month, analysis of leaked data from TopSec, a Beijing-based cybersecurity firm, revealed how China’s private sector provides Censorship as a Service to enforce government content monitoring. The leaked work logs showed TopSec delivering bespoke monitoring services to a state-owned enterprise precisely when a corruption investigation was announced, offering rare insight into public-private coordination for managing sensitive events and controlling public opinion in China.

February concluded with discovery of a new Ghostwriter campaign targeting both the Ukrainian government and, for the first time, Belarusian opposition groups. The long-running threat activity cluster deployed weaponized Excel documents with lures crafted to appeal to government officials and opposition activists, marking an expansion of the campaign’s targeting scope.

Key Takeaway: The TopSec leak reveals how China’s private cybersecurity sector directly enables state surveillance and censorship operations, highlighting the interconnected nature of commercial security firms and government offensive capabilities.

March

March was marked by several significant ransomware developments. Mid-month, SentinelLABS reported on Dragon RaaS, a pro-Russian hacktivist group attempting to build on the reputation of “The Five Families” cybercrime ecosystem. The group’s emergence reflected the continued  fragmentation and rebranding within ransomware operations.

The month also saw publication of research on ReaderUpdate, a macOS malware loader that had been largely dormant since 2023. New samples showed the threat actors had expanded the loader’s capabilities by adding Go to its existing arsenal of Crystal, Nim, and Rust variants, creating a “melting pot” of macOS malware designed to evade detection through diverse implementation languages.

Key Takeaway: ReaderUpdate’s use of multiple programming languages (Crystal, Nim, Rust, Go) presents unique challenges for detection and analysis, necessitating detection strategies that focus on behavior and artifacts rather than language-specific signatures.

April

April brought the discovery of AkiraBot, an AI-powered Python framework using OpenAI to generate custom spam messages targeting website contact forms and chat widgets.

Since September 2024, the bot had targeted more than 400,000 websites and successfully spammed at least 80,000 sites promoting dubious SEO services. The framework’s sophistication, including multiple CAPTCHA bypass mechanisms and network detection evasion techniques, illustrated how AI lowers barriers for scaled attacks even when the underlying criminal objective remains straightforward.

Later in the month, SentinelLABS published research on what it takes to defend a top-tier cybersecurity company from today’s adversaries. Drawing on SentinelOne’s own experiences as a target of advanced persistent threats, the research provided insight into the resources and capabilities required to protect organizations that themselves represent high-value targets for nation-state actors seeking to compromise security vendors.

Key Takeaway: AI-generated content in AkiraBot bypasses traditional spam filters by creating unique messages for each target, exposing the challenges AI poses to traditional website spam defenses.

May

May opened with our reporting on DragonForce, a ransomware gang that had completed its transformation from Pro-Palestine hacktivist operation to profit-driven extortion enterprise. The group introduced a “white-label” branding service in early 2025, allowing affiliates to rebrand DragonForce ransomware as different strains for additional fees, marking a new level of commercialization within the RaaS ecosystem.

Shortly afterward, SentinelLABS and Validin unveiled FreeDrain at PIVOTcon. Our collaboration exposed an industrial-scale cryptocurrency phishing operation using SEO manipulation and over 38,000 distinct subdomains across free publishing platforms. The investigation began with a victim who lost approximately $500,000 worth of Bitcoin and expanded to reveal a professional criminal enterprise operating during standard business hours from the UTC+05:30 timezone, systematically stealing digital assets through multilayered redirection techniques.

Anti-Ransomware Day 2025 marked the sobering milestone of ten years of Ransomware-as-a-Service, now a billion-dollar criminal industry. SentinelLABS’ retrospective examined how RaaS operations had evolved from early experiments into sophisticated criminal enterprises with mature business models, customer service, and ongoing innovation.

A busy month for our researchers concluded with documentation of ClickFix techniques embedding fraudulent CAPTCHA images on compromised websites. We shared original findings from SentinelOne investigations, including infection chains and technical artifacts not previously reported.

Key Takeaway: FreeDrain’s abuse of thousands of subdomains on trusted free-tier platforms demonstrates that without stronger default safeguards, identity verification, or proper abuse response infrastructure, free publishing platforms will continue to be abused, undermining user trust and inflicting real-world financial harm.

June

SentinelLABS expanded on its earlier research on adversaries targeting top-tier organizations, detailing a China-nexus threat actor’s reconnaissance operation against SentinelOne itself that had occurred in October 2024 and extended into 2025. The research highlighted adversaries’ persistent focus on compromising cybersecurity vendors and high-value targets.

Also in June, we reported on Katz Stealer, an emerging Malware-as-a-Service platform targeting credentials and crypto assets. Advertised on BreachForums in April 2025, Katz Stealer followed the established RaaS business model, offering services to affiliates for upfront fees and demonstrating the continued commercialization of information stealer operations.

We reported on two separate Mac-focused campaigns in June, attributed in turn to China and North Korean threat actors. Our researchers found evidence of macOS.ZuRu’s re-emergence with a modified Khepri C2 framework concealed inside a trojanized version of the legitimate Termius SSH client. We also detailed intrusions attributed to DPRK activity and the macOS NimDoor malware family: a Nim-based backdoor specifically designed to target Web3 and crypto platforms. The research extended understanding of North Korean threat actors’ evolving macOS malware playbook and their persistent focus on the cryptocurrency sector.

Key Takeaway: DPRK’s exploration of lesser-known languages in order to introduce analysis complexity requires security engineers to invest equal effort in understanding the affordances such languages offer threat actors.

July

One of the year’s most significant zero-day disclosures was revealed when Microsoft confirmed active exploitation of SharePoint ToolShell (CVE-2025-53770) on July 19th, two days after SentinelOne first observed ToolShell exploitation. SentinelLABS researchers subsequently documented targeted exploitation against high-value organizations in technology consulting, manufacturing, critical infrastructure, and professional services.

The vulnerability enabled unauthenticated remote code execution through crafted POST requests, with attacks occurring before public disclosure spurred mass exploitation. Further research found multiple state-aligned threat actors beginning reconnaissance and early-stage exploitation activities.

Later in July, following Department of Justice indictments of two hackers working for China’s Ministry of State Security, SentinelLABS identified more than ten patents for highly intrusive forensics and data collection technologies registered by companies linked to the Hafnium (Silk Typhoon) threat actor group.

The patents revealed previously unreported offensive capabilities including encrypted endpoint data acquisition, mobile forensics, and network traffic collection, exposing the sophisticated technical infrastructure supporting China’s APT operations and highlighting critical gaps in traditional campaign-focused attribution.

Key Takeaway: Campaign-focused attribution misses the full picture. Understanding the companies behind attacks and their documented capabilities, not just observed behavior, is essential for comprehensive threat intelligence.

August

In early August, SentinelLABS and Beazley Security exposed the PXA Stealer campaign, a Python-based operation that had infected more than 4,000 unique victims across 62 countries. The stolen data included over 200,000 passwords, hundreds of credit card records, and more than 4 million browser cookies, and was monetized through a Vietnamese-speaking cybercriminal ecosystem using Telegram APIs. The campaign demonstrated increasingly advanced tradecraft with nuanced anti-analysis techniques, non-malicious decoy content, and hardened command-and-control infrastructure.

This month, SentinelLABS also exposed widespread smart contract scams, where actors advertised crypto trading bots concealing malicious contracts designed to drain user wallets. Promoted through fake YouTube channels and AI-generated videos, the scams demonstrated how threat actors leverage social media and emerging technologies to lend legitimacy to financial fraud schemes.

Key Takeaway: Stealer campaigns have become increasingly automated and supply-chain integrated. PXA Stealer exemplifies a growing trend in which legitimate infrastructure is weaponized at scale.

September

SentinelLABS, in collaboration with Validin, exposed how North Korean threat actors behind the Contagious Interview campaign were actively monitoring cyber threat intelligence platforms to detect infrastructure exposure.

The research revealed coordinated teams using Slack for real-time collaboration and rapidly deploying replacement infrastructure when services took down their assets. Between January and March 2025 alone, our efforts identified more than 230 victims, predominantly cryptocurrency professionals, with the actual number likely significantly higher.

Later in September, SentinelLABS published groundbreaking research on hunting for LLM-enabled malware. Facing the challenge that malware offloading functionality to AI could generate unique code at runtime and evade traditional detection, our researchers developed novel methodologies based on embedded API key detection and specific prompt structure patterns.

This approach successfully identified previously unknown samples including MalTerminal, potentially the earliest known example of LLM-enabled malware. Despite initial concerns about detection challenges, the research showed how defenders could reliably hunt for and detect these emerging threats.

Key Takeaway: LLM-enabled malware is still in a nascent stage, giving defenders an opportunity to learn from attackers’ mistakes and adjust their approaches accordingly.

October

In late October, following intelligence shared by the Digital Security Lab of Ukraine, SentinelLABS investigated PhantomCaptcha, a coordinated single-day spearphishing operation launched on October 8th targeting organizations critical to Ukraine’s war relief efforts.

The threat actors used emails impersonating the Ukrainian President’s Office carrying weaponized PDFs, luring victims into executing malware via a ‘ClickFix’-style fake Cloudflare captcha page. The final payload was a multi-stage WebSocket RAT, hosted on Russian-owned infrastructure,  with an array of offensive features including arbitrary remote command execution, data exfiltration, and the potential deployment of additional malware.

The campaign reflects a highly capable adversary with extensive operational planning, compartmentalized infrastructure, and deliberate exposure control. The six-month period between initial infrastructure registration and attack execution, followed by the swift takedown of user-facing domains while maintaining backend command-and-control, indicates an operator well-versed in both offensive tradecraft and defensive detection evasion.

Key Takeaway: User awareness training on “ClickFix”-style social engineering techniques can help prevent attacks using this infection vector. PowerShell logging provides visibility into commands using hidden window styles, execution policy bypasses, or attempts to disable command history logging, while network security teams can monitor for WebSocket connections to recently-registered or suspicious domains.

November

As part of our efforts to empower the community at large through research and adversary exposure, SentinelLABS also develops and releases open source tooling. In November, we released a Synapse Rapid Power Up for Validin to improve campaign discovery at scale. Our research showed how modern intelligence platforms could accelerate identification of threat campaigns through infrastructure correlation and automated discovery techniques.

Using the LaundryBear and FreeDrain campaigns as case studies, we explored how the sentinelone-validin power-up leverages Validin’s multi-source enrichment and HTTP fingerprinting to reveal wider campaign infrastructure within Synapse from just a handful of indicators.

The tool makes it easier to follow how infrastructure changes over time, trace shared resources across campaigns, and connect what might first appear as isolated indicators. With this richer context available directly in Synapse, analysts can move from collection to understanding with greater speed and confidence in their conclusions.

Key Takeaway: Modern adversaries rotate domains and replicate infrastructure templates, which can limit the value of isolated indicators. Analysts need time-aware, cross-source analysis to identify shared traits and connect related assets.

December

Early in December, SentinelLABS released its forward-looking “Cybersecurity 2026” forecast, examining the year ahead in AI, adversaries, and global change. The analysis drew on trends observed throughout 2025 to project how the threat landscape would continue evolving.

This month we also traced how two hackers progressed from Cisco Academy students to orchestrating Salt Typhoon attacks, providing rare insight into how technical education can be perverted toward malicious ends and highlighting the danger of threat actors emerging from legitimate training programs.

December also saw reporting on CyberVolk’s return with VolkLocker. The pro-Russian hacktivist collective continued its pattern of reusing, tweaking, and rebranding leaked ransomware source code.

The year concluded with comprehensive research on how large language models impact ransomware operations. The analysis found that while LLMs are being adopted by crimeware actors, they serve as operational accelerators rather than revolutionary tools, streamlining reconnaissance, improving phishing, and speeding up attack stages without fundamentally changing ransomware methodology.

Key Takeaway: With today’s LLMs, the risk is not superintelligent malware but industrialized extortion, requiring defenders to adapt to faster operational tempo rather than novel capabilities.

Conclusion

2025 saw the cybersecurity landscape defined not by revolutionary changes but by the acceleration of existing threats. AI has emerged not as a game-changer but as a force multiplier, amplifying attacks across the spectrum.

Meanwhile, cybercriminals operate industrial-scale operations with professional infrastructure, business hours, and customer service models much like legitimate enterprises, and nation-state actors monitor the same intelligence platforms defenders use, turning the information security community’s own tools into reconnaissance resources.

Our research over the last 12 months has also found an adversary landscape in which attribution has become increasingly complex, and the line between hacktivist and profit-motivated operations continues to blur. From the 38,000 phishing subdomains of FreeDrain to the coordinated teams behind Contagious Interview monitoring threat intelligence platforms, threat actors have shown both adaptability and operational maturity.

SentinelLABS’ discoveries throughout 2025 underscore the critical need for a collaborative, intelligence-driven approach to cybersecurity. As we move into 2026, defenders will find themselves in an environment where trust models require reevaluation,  adversaries demonstrate sophisticated awareness of defensive operations, and the weaponization of legitimate services demands new detection paradigms.

Singularity Platform

Elevate your security posture with real-time detection, machine-speed response, and total visibility of your entire digital environment.

Get a Demo

With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.

However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.

As adversaries exploit an ever-wider range of potential entry points — both new and old — security leaders must strike a balance to ensure that they’re capable of addressing all risks effectively.

Cyber crime is still a human problem

Despite overwhelming hype, technology is not a panacea. It can’t replace human expertise in every domain, and AI alone can’t match the innately human qualities of intuition and creative thinking. Adversaries know this too, which is why the smarter — and much more dangerous — ones use a blend of human- and technology-powered tactics.

While major technical vulnerabilities tend to make the headlines, the reality is that the weakest link is almost always the human element. Almost all attacks involve a social engineering element, and despite the buzz around generative AI and deepfakes helping scale such attacks, it’s human-to-human interaction where the greatest risks lie.

Synthetic content is now all around us, and people are getting better at telling it apart. Whether we get to the point when that’s no longer the case is a topic for another discussion. But for now, the most dangerous and effective social engineering attacks still depend primarily on human conversations, whether by phone, email or even in person. After all, a seasoned attacker can build trust and forge sham relationships in a way that no AI nor deepfake can match.

Cyber espionage remains a serious threat

Take state-sponsored cyber espionage, for example. Highly trained social engineers are a far cry from the typical rabble of independent cyber crime rackets operating off the dark web, who tend to rely more on scale than targeting specific enterprises and individuals. These attackers may target data systems, but when it comes to their own arsenals, their talents in manipulation and deception are by far their greatest weapons.

Technology still has a long way to go before it can come close to matching the age-old tactics of spycraft.

When facing an attacker who can pose effectively as an internal employee or any other trusted individual, someone relying solely on technology to mitigate the threat stands little chance of protecting themselves. That isn’t a technology failure. It’s a process failure, hence why the human element must always be a key factor in any cybersecurity strategy.

Of course, that’s not to say technology doesn’t have a vital role to play in bolstering your cyber defenses. It most certainly does, not least, because more and more routine threats are being automated or are carried out en-masse by attackers who are less skilled or experienced. The value of technology — especially AI-powered cybersecurity automation — exists primarily in its ability to free up time for security leaders to focus on the threats that technology alone can’t solve.

It’s not all about the cloud, either

The majority of business data is now stored in the cloud, and the percentage continues to rise. Many businesses, especially smaller organizations and startups, exclusively use the cloud for data storage and other IT operations. The rise of AI, given how computationally demanding it is, is further accelerating cloud adoption.

Nonetheless, cloud computing isn’t the best option in all situations. On-premises remains the preferred choice for high-performance workloads that require extremely low latencies. In some cases, on-premises computing is also the cheaper option, and that’s unlikely to change in the near future.

Even though more companies are migrating to the cloud, that doesn’t mean they don’t keep sensitive data on-site. For instance, edge computing, which brings data processing closer to where it’s needed, has become a critical enabler in certain use cases. Examples include smart energy grids, remote monitoring of industrial assets and autonomous vehicles. These include cases where you can’t always rely on internet connectivity.

The smarter and better-funded adversaries aren’t just targeting cloud-hosted infrastructure. They’re also setting their sights on local servers and cyber-physical systems, such as industrial control systems and hardware supply chains. The fact that there’s often minimal collaboration between logistics, production and cybersecurity departments makes these risks all the more serious.

Ransomware remains one of the biggest threats targeting on-premises systems despite the small reduction in attacks over the last year. While cloud systems aren’t inherently immune from ransomware attacks, the vast majority target bare-metal hypervisors and local servers. In one recent case, the Akira ransomware group reverted to its earlier double extortion tactics, experimenting with different code frameworks to target systems running ESXi and Linux.

Botnets are another growing concern as the number of IoT devices continues to soar. Used to launch distributed denial of service (DDoS) attacks spanning thousands of devices, these botnets primarily target unsecured IoT devices, like those that monitor and operate industrial machines and critical infrastructure. One recent report discovered that DDoS attacks against critical infrastructure have increased by 55% in the last four years. These attacks don’t directly involve the exfiltration of sensitive data, but given how they can cause widespread disruption, adversaries may rely on them to draw attention away from more serious threats.

Why physical security is still relevant

As security leaders focus on locking down their cloud-hosted assets, they cannot afford to lose sight of the risks facing their physical infrastructure. Sometimes, the easiest way into the cloud is from within.

Even thin clients and dumb terminals — both widely used in high-security environments like healthcare and finance — can potentially give attackers a foothold in wider systems, including cloud infrastructure and remote data centers. Edward Snowden proved that while working at the National Security Agency when he exfiltrated 20,000 government documents stored on the servers in NSA’s headquarters 5,000 miles away. He did so without using any advanced technology. While that happened way back in 2013, and the NSA has long since updated its physical security protocols, the risk is just as relevant today as it was then.

While most thin clients are now protected by multiple layers of security, including encryption and multifactor authentication, these solutions alone can’t fully protect against physical compromise. If an attacker gains access to a terminal — perhaps by way of social engineering — they may be able to compromise it using unauthorized peripherals or by directly manipulating the device’s firmware. This could give them access to the wider network, potentially allowing for the injection of customized malware that goes undetected by regular security scans.

IoT devices are another leading reason behind the expansion of attack surfaces. They often lack adequate security, also giving attackers a potential entry point into the broader computing infrastructures they’re connected to. The fact that these connected technologies are being rolled out en masse in areas like smart cities, critical infrastructure and transportation networks, greatly magnifies such vulnerabilities.

Ultimately, if an attacker is able to get past your physical safeguards, then these connected systems present far easier pathways to an organization’s so-called “crown jewels” than trying to break through multi-layered cloud defenses.

Cloud data is not always the true target

In other cases, data hosted in the cloud might not be the attacker’s end goal. Many companies, such as those subject to stringent data residency regulations or that require high performance for real-time applications, still store their data on on-premises servers.

Some of these systems are air-gapped, meaning they’re entirely disconnected from any other networks, including the Internet itself. While more secure than any cloud-hosted server, at least in theory, their security can’t be taken for granted. For instance, anyone with physical access to the servers may be able to compromise them, either maliciously or accidentally.

Physical security, such as CCTV and biometric security checkpoints, is as important as ever in such cases. But it’s not just about protecting against intentional physical tampering. Indirect attacks orchestrated by highly skilled social engineers can also dupe unsuspecting employees into taking a desired action — such as lending them a biometric security access card.

These are not the sort of adversaries that usually work by email or use AI to scale their attacks – they’re far likelier to deceive someone in person, a tactic as old as humanity itself. In fact, the attacker could be anyone, such as a disgruntled former employee, a hacker operating in the interests of a rival company or even a rogue state.

Bridging the gap between digital and human security

Technology alone can’t protect an organization from the myriad threats out there, and neither can humans keep up with ever-expanding system logs and security information feeds if they’re relying solely on manual processes.

The reality is that you need both, starting with people and using technology to broaden their capabilities. A layered security strategy should typically start with locking down physical access to any data-bearing system or system that is connected to another.

The next layer of defense is the human one. This revolves heavily around security awareness training. But the reality is that many programs are ineffective, either because they lack practical application, are overly reliant on generic content or focus too much on technical factors that are beyond the target audience’s understanding.

Phishing simulations are often similarly limited in their scope, focusing on common lures like trending news topics, a sense of urgency or even outright threats. However, more sophisticated attackers tend to use subtler ways to elicit a response. This could be something as simple as sending messages about a routine policy update regarding company dress code or remote work guidelines. These topics might seem trivial, but they can pique interest, especially when they concern changes to daily routines and work-life balance. Attackers could then use this to dupe unsuspecting victims into divulging sensitive information via a sham survey.

Like any other security measure, physical systems and awareness training will only ever be effective if they’re tested regularly. That’s where physical red teaming comes in. Whereas red teaming in the context of IT focuses on technical measures like penetration testing, physical red teaming is all about having teams try to gain entry to restricted areas and systems. To do so, they might use a blend of simulated social engineering attacks and technology to hack into physical security systems. By attempting to bypass physical security barriers or impersonate staff, red teams can reveal gaps that might otherwise go unnoticed. That’s what makes them a valuable part of any comprehensive information security program.

The post AI and cloud vulnerabilities aren’t the only threats facing CISOs today appeared first on Security Intelligence.

Organizations often set up security rules to help reduce cybersecurity vulnerabilities and risks. The 2024 Cost of a Data Breach Report discovered that 40% of all data breaches involved data distributed across multiple environments, meaning that these best-laid plans often fail in the cloud environment.

Not surprisingly, many organizations find keeping a robust security posture in the cloud to be exceptionally challenging, especially with the need to enforce security policies consistently across dynamic and expansive cloud infrastructures. The recently released X-Force Cloud Threat Landscape 2024 Report delved into which specific rules are most commonly failing. By understanding key vulnerabilities, organizations can then figure out the best approach for reducing their risks.

“Regulations are increasing, requiring organizations to implement more compliance policies with security top of mind, which puts a lot of overhead on these organizations,” says Mohit Goyal, Product Management at Red Hat Insights. “The Compliance service within Red Hat Insights provides a more elegant way to manage and deploy these policies on systems to get ahead of any gaps.”

Environment influences failure of security rules

During the research, X-Force analyzed two sets of data across the cloud — one set operating in 100% cloud-only environments and the other with a hybrid of 50% to 99% of their Red Hat Enterprise Linux (RHEL) systems in the cloud. Interestingly, researchers found a different set of most failed rules for each of the two different groups.

Goyal says that the team intentionally looked at both environments because Red Hat caters to customers across the hybrid cloud. During the research, the team discovered that in the 100% cloud group, security rules often failed due to misconfiguring assets, meaning that organizations should focus on configuration guidelines. Meanwhile, in the hybrid environment, most failed rules revolved around authentication and cryptography policies.

When asked who is often responsible for the configurations, Goyal says it varies at different organizations. At smaller companies, a single employee often wears multiple hats. However, at larger organizations, the roles are typically well defined with multiple people involved — for example, a system administrator, a security/risk administrator and a compliance administrator.

Top failed rules in organizations with 100% cloud systems

Researchers found that in situations where all data was stored in the public cloud, the most commonly failed rule was configuration and security guidelines for Linux systems. Researchers described this rule as focusing on configuring essential security and management settings in Linux systems. Examples include setting the default zone for the firewall and isolating the /tmp directory on a separate partition to enhance security and manage disk space effectively. The mitigation is configuring the default zone for the firewall service to make sure the network security is properly configured in Red Hat-based systems.

Other top failed rules include:

• Secure mount options for critical directories
• User home directory management
• Service management
• NFS service management

Top failed rules in organizations with hybrid environments

After analyzing data within a hybrid environment, researchers found that authentication and cryptography policies often failed. These rules focus on standardizing and securing authentication mechanisms and cryptographic requirements in a given policy. Organizations set these rules to ensure consistent and strong security practices across the system. The mitigation involves authselect to standardize and simplify the management of authentication settings.

Other commonly failed rules in hybrid environments include:

• Account and SSH configuration
• SSH security measures
• Umask configuration
• Process debugging restrictions

Why mitigation commonly fails

Because each rule contains mitigation, a common question from the report was why mitigations so often fail. But the answer is not a simple one. The reasons can include a wide range of factors, including misconfiguration, lack of training and different environments.

“Security, in general, is a complex area, and with the threat landscape constantly changing and evolving, it’s hard to maintain the status quo,” Goyal says. “As new technologies and new requirements come into play and the footprint increases, it ultimately leads to a lot of complexity.”

Goyal predicts that the policies are going to increase in number and only become more complex. Organizations need solutions to keep their head wrapped around the complexities in a way that reduces the burden of operational overhead. By highlighting the gaps, leaders can understand where the risk lies and create a plan to close those gaps.

Reducing rule failures

Confirming that all rules are followed and the mitigation is used correctly when a rule fails is time-consuming, explains Goyal. At large enterprises, cybersecurity professionals bear a lot of burden with complex processes. Team members must constantly optimize and check for security while also completing other tasks. Organizations are increasingly turning to Ansible automation, such as with Red Hat Insights, for more effective and efficient remediation.

With Red Hat Insights, an organization can deploy its compliance policies (i.e.: a PCI or HIPAA data governance policy, etc.) on RHEL systems. After analyzing these systems, Insights then displays the level of compliance/non-compliance of the systems to the organization’s policies; it also recommends actions to address the non-compliance. Organizations can select to deploy the Ansible playbook on the systems with just a few clicks to become compliant again. Because the process is automated, it’s more effective and efficient than manually identifying and remediating each system separately.

“Large enterprises need this ability to help keep their costs in control and prevent security gaps from being exploited by bad actors,” says Goyal.

Cloud security: A shared responsibility

Because multiple organizations are involved in a cloud environment, a key question is often about who bears the responsibility for security — the organization or the vendor. Goyal says that security is a dual responsibility.

“As a vendor to our customer, there is a responsibility to make sure they have a product that is built with its security posture front-and-center and has feature-rich functionality that allows organizations to effectively manage their organizational IT security strategy. However, they have to also configure and deploy the product correctly,” says Goyal. “Additionally, organizations need to make sure that their cloud provider emphasizes operational security. At the same time, organizations also need to take ownership for the security of the configurable components of their environment.”

The post 2024 Cloud Threat Landscape Report: How does cloud security fail? appeared first on Security Intelligence.

IBM’s X-Force team recently released the latest edition of the Cloud Threat Landscape Report for 2024, providing a comprehensive outlook on the rise of cloud infrastructure adoption and its associated risks.

One of the key takeaways of this year’s report was focused on the gradual decrease in Software-as-a-Service (SaaS) platforms being mentioned across dark web marketplaces. While this trend potentially points to more cloud platforms increasing their defensive posture and limiting the number of exploits or compromised credentials that are surfacing, there are a few other factors to consider.

Sudden decrease in SaaS mentions across the dark web

In a recent collaboration with Cybersixgill, a leading dark web intelligence firm, IBM’s X-Force provided updated statistics in its recent Cloud Threat Landscape Report surrounding the number of SaaS solutions mentioned across the dark web.

Surprisingly, even though compromised cloud solutions are still highly relevant and valuable assets when creating sellable assets across dark web marketplaces, the number of SaaS platforms being mentioned dropped by an average of 20.4% year-over-year.

Among some of the highest reductions was WordPress-Admin, declining nearly 98% between 2023 and 2024, followed by Microsoft Active Directory and ServiceNow, which saw a 44% and 38% decline, respectively.

While the majority of SaaS platforms mentioned decreased year-over-year, Microsoft TeamViewer was an outlier. Even though the platform only represented 1.8% of all of the mentioned SaaS solutions, it still saw an increase of 9% between 2023 and 2024.

What are the potential contributors to less SaaS mentions?

The decreased activity in SaaS mentions initially points to a potentially emerging trend in the sophistication of modern-day cybersecurity solutions. However, as with all first-year statistical report shifts, it’s important to consider all calculation variables and contributing factors.

To help shed some more light on these figures, Colin Connor, a member of IBM’s X-Force team, was interviewed to provide additional perspective. When asked to comment on the potential driver of this dark web trend shift, Connor states, “These statistics appear to be an overall trend that was also referenced in the decrease in total compromised credentials sold during the same reporting period. This also coincides with the takedown of Raccoon Stealer, which caused a prolonged decrease in credential sales from July 2023 onward.”

Racoon Stealer was one of the most widely used infostealer malware that dominated the majority of the dark web market share for credential stealers starting in 2022 but was taken down by the FBI in August of 2023.

Commenting on the overall impact Racoon Stealer had on the year-over-over statistics of this report, Connor says, “During its peak in March 2023, was nearly 87% of the source of stolen logs and accounted for almost 50% of the stolen credentials in our 2023 collection. It’s also important to remember that the majority of dark web credentials sold are stolen from infostealer malware. So, this takedown of Raccoon had a dramatic effect. The marketplace continues to recover — from 192,000 credential sets overall for sale in July 2023 to 721,000 in July 2024. It also has yet to recover from the peak in March 2023 — which equated to 1.2 million credential sets for sale.”

Will there be a resurgence of compromised SaaS platforms in the near future?

According to IBM’s X-Force team, while the year-over-year decline of SaaS mentions on the dark web is positive — pointing to increased law enforcement actions against major dark web marketplaces and enhanced security measures being taken by large enterprises — it’s critical not to allow this to let organization’s guard down.

When asked about what the most recent Raccoon Stealer takedown means for the shifting dark web market dynamics, Connor states, “Racoon’s ability to recover in 2024 was limited, but what we’re seeing is that the relatively smaller players are starting to grow… We saw that Luma, RisePro and Stealc have now become major players… Luma especially took a huge step up, showing a 241% in popularity in Q3.”

It’s still too early to know if these previously smaller players will have the stamina to create disruptions similar to Raccoon Stealer across the dark web in the next couple of years. There is also the possibility that Racoon Stealer will see some form of recovery in the future.

The important thing is that organizations don’t become complacent in their proactive security planning. IBM’s X-Force team recommends that all organizations continue to conduct comprehensive security testing across their on-premise and cloud infrastructure while regularly strengthening their incident response capabilities. This helps to ensure that even when trends begin to shift, organizations can mitigate their risks of having systems or networks compromised.

The post Cloud threat report: Why have SaaS platforms on dark web marketplaces decreased? appeared first on Security Intelligence.

For the last couple of years, a lot of attention has been placed on the evolutionary state of artificial intelligence (AI) technology and its impact on cybersecurity. In many industries, the risks associated with AI-generated attacks are still present and concerning, especially with the global average of data breach costs increasing by 10% from last year.

However, according to the most recent Cloud Threat Landscape Report released by IBM’s X-Force team, the near-term threat of an AI-generated attack targeting cloud computing environments is actually moderately low. Still, projections from X-Force reveal that an increase in these sophisticated attack methods could be on the horizon.

Current status of the cloud computing market

The cloud computing market continues to grow exponentially, with experts expecting its value to reach more than $675 billion by the end of 2024. As more organizations expand their operational capabilities beyond on-premise restrictions and leverage public and private cloud infrastructure and services, adoption of AI technology is steadily increasing across multiple industry sectors.

Generative AI’s rapid integration into cloud computing platforms has created many opportunities for businesses, especially when enabling better automation and efficiency in the deployment, provisioning and scalability of IT services and SaaS applications.

However, as more businesses rely on new disruptive technologies to help them maximize the value of their cloud investments, the potential security danger that generative AI poses is something closely monitored by various cybersecurity organizations.

Why are AI-generated attacks in the cloud currently considered lower risk?

Although AI-generated attacks are still among the top emerging risks for senior risk and assurance executives, according to a recent Gartner report, the current threat of AI technologies being exploited and leveraged in cloud infrastructure attacks is still moderately low, according to X-Force’s research.

This isn’t to say that AI technology isn’t still being regularly used in the development and distribution of highly sophisticated phishing schemes at scale. This behavior has already been observed with active malware distributors like Hive0137, who make use of large language models (LLMs) when scripting new dark web tools. Rather, the current lower risk projections are relevant to the likelihood of AI platforms being directly targeted in both cloud and on-premise environments.

One of the primary reasons for this lower risk has to do with the complex undertaking it will take for cyber criminals to breach and manipulate the underlying infrastructure of AI deployments successfully. Even if attackers put considerable resources into this effort, the still relatively low market saturation of cloud-based AI tools and solutions would likely lead to a low return on investment in time, resources and risks associated with carrying out these attacks.

Preparing for an inevitable increase in AI-driven cloud threats

While the immediate risks of AI-driven cloud threats may be lower today, this isn’t to say that organizations shouldn’t prepare for this to change in the near future.

IBM’s X-Force team has recognized correlations between the percentage of market share new technologies have across various markets and the trigger points related to their associated cybersecurity risks. According to the recent X-Force analysis, once generative AI matures and approaches 50% market saturation, it’s likely that its attack surface will become a larger target for cyber criminals.

For organizations currently utilizing AI technologies and proceeding with cloud adoption, designing more secure AI strategies is essential. This includes developing stronger identity security postures, integrating security throughout their cloud development processes and safeguarding the integrity of their data and quantum computation models.

The post Cloud Threat Landscape Report: AI-generated attacks low for the cloud appeared first on Security Intelligence.