Credit: Dreamstime
As connectivity to cloud-based resources grows, cybercriminals are using valid, compromised credentials to access enterprise resources at an alarming rate.
That's one of the chief findings of the IBM X-Force Cloud Threat Landscape Report, which also found a 200 per cent increase (about 3,900 vulnerabilities) in cloud-oriented Common Vulnerabilities and Exposures (CVE) in the last year.
“Over 35 per cent of cloud security incidents occurred from attackers’ use of valid, compromised credentials,” wrote Chris Caridi, strategic cyber threat analyst with IBM X-Force, in a blog about the report. “Making up nearly 90% of assets for sale on dark web marketplaces, credentials’ popularity among cybercriminals is apparent, averaging $10 per listing – or the equivalent of a dozen doughnuts.”
With the increased use of edge, branch and remote networked users accessing multi cloud environments, it is clear organisations need to tighten the access privileges IT gives those users.
In fact, X-Force found plain text credentials located on user endpoints in 33% of engagements involving cloud environments.
“In particular, there was a high frequency of service account credentials stored on endpoints, and many were over-privileged. Excessively privileged users can be defined as those who have more permissions than they need to do their job or task,” the report stated.
“Compromised credentials caused over one-third of cloud-related incidents that the X-Force team observed, suggesting that businesses are challenged to balance user access needs and security risks," the report stated.
Once successful, cybercriminals can take advantage of this access to facilitate their ultimate objective, which can involve deploying cryptominers, ransomware and other types of malware, X-Force stated.
“Organisations can benefit from AI-powered identity protections that help identify behavioral anomalies in depth and verify users’ identity,” the report stated.
Other common attack vectors include the exploitation of public-facing applications and phishing/spear phishing links, each of which represented approximately 14 per cent of incidents the X-Force team responded to.
Microsoft Outlook Cloud credentials accounted for over 5 million mentions on illicit marketplaces – by far the most popular access for sale, Caridi stated.
The exploitation of vulnerabilities in public-facing applications is a tried-and-true access vector for threat actors in cloud and local environments alike, the report stated.
“Cloud applications are typically more challenging for organisations to manage due to the increasing number of applications and services used in a modern cloud or hybrid cloud environment,” the report stated. “If implemented improperly, it’s possible to overlook an outdated application running in the cloud, or worse, be unaware that the application is even in use.”
A few of the other key report findings include:
- The X-Force team has observed adversaries installing proxyware – a legitimate network segmentation tool – on unsuspecting victims’ systems to resell the victims’ computer bandwidth. Research suggests that a proxyjacking campaign could net threat actors roughly $9.60 within 24 hours for one IP address, and deploying it by Log4j could provide $220,000 in profit per month. Additionally, proxyjacking can result in victims being hit with large cloud provider charges due to the increase in unexpected web traffic.
- Nearly 60 per cent of newly disclosed vulnerabilities, if exploited, could allow attackers to obtain information or either gain access or privileges that enable lateral movement through the network. From providing attackers information on how environments are set up to unauthorised authentication that can grant them additional permissions, it’s critical for organisations to know which risks to prioritise – especially when operating with limited resources.
- The Chaos Remote Administrative Tool (Trojan.Linux.CHAOSRAT) is being deployed as a remote access tool (RAT). Chaos RAT functions include reverse shell file download, upload and delete; screenshots; operating system information gathering; shutting down and restarting the host; and opening URLs. This RAT shows the sophistication and evolution of cloud-based threat actors.
The X-Force researchers made a number of suggestions in response to their findings. For example, they said customers should utilise zero trust security technologies to include implementation of multifactor authentication (MFA) and the principle of least privilege.
“This strategy is especially important for private clouds that may interact with other on-premises assets on a regular basis,” the report stated. “Modernise identity and access management (IAM) to reduce reliance on username and password combinations and combat threat actor credential theft.”
They also recommended using AI-based capabilities to help scrutinise digital identities and behaviors, verify their legitimacy, and deliver smarter authentication.
The threat landscape report is based on data gathered from X-Force threat intelligence, penetration tests, incident response engagements, Red Hat Insights and data provided by report contributor Cybersixgill between June 2022 and June 2023.
