CrowdStrike saw a 583% explosion in Kerberoasting identity attacks and three-fold spike in malicious use of legitimate RMM tools between July 2022 and June 2023 while adversary breakout time hits a record low of that period.
CrowdStrike found a nearly six-time year-over-year spike in Kerberoasting attacks, a technique adversaries can abuse to obtain valid credentials for Microsoft Active Directory service accounts, often providing actors with higher privileges and allowing them to remain undetected in victim environments for longer periods of time.
Overall, 62% of all interactive intrusions involved the abuse of valid accounts, while there was a 160% increase in attempts to gather secret keys and other credentials via cloud instance metadata APIs.
The company also saw a 312% YoY increase in adversaries leveraging legitimate RMM tools. Giving further credence to reports from CISA, adversaries are increasingly using legitimate and well-known remote IT management applications to avoid detection and blend into the noise of the enterprise in order to access sensitive data, deploy ransomware or install more tailored follow-on tactics.
Further, the average time it takes an adversary to move laterally from initial compromise to other hosts in the victim environment fell from the previous all time low of 84 minutes in 2022 to a record 79 minutes in 2023.
Additionally, the fastest breakout time of the year was recorded at just seven minutes.
The financial industry saw an 80% YoY increase in interactive intrusions. Defined as intrusions that use hands-on keyboard activity, interactive intrusions were up 40% overall.
Access Broker advertisements increase by 147% on criminal or underground communities. Ready access to valid accounts for sale lowers the barrier to entry for eCrime actors looking to conduct criminal operations, and allow established adversaries to hone their post-exploitation tradecraft to achieve their objectives with more efficiency.
Finally, CrowdStrike witnessed a threefold increase in Linux tool linPEAS, which adversaries use to gain access to cloud environment metadata, network attributes, and various credentials that they can then exploit.
“In our tracking of over 215 adversaries in the past year, we have seen a threat landscape that has grown in complexity and depth as threat actors pivot to new tactics and platforms, such as abusing valid credentials to target vulnerabilities in the cloud and in software,” said Adam Meyers, head of Counter Adversary Operations at CrowdStrike.
“When we talk about stopping breaches, we cannot ignore the undeniable fact that adversaries are getting faster and they are employing tactics intentionally designed to evade traditional detection methods,” said Meyers. “Security leaders need to ask their teams if they have the solutions required to stop lateral movement from an adversary in just seven minutes.”
