Cloud future overcast by security concerns 

Cloud services are crucial elements of many business processes. Cloud computing allows businesses to reduce costs, accelerate deployments, develop at scale, share files easily and collaborate efficiently without needing a centralized location.

However, these same services are increasingly abused by malicious actors — a trend that is likely to continue in the foreseeable future. Threat actors are now fully aware of how vital cloud services are, making them a perfect breeding ground for eCrime. These are the key findings from 2022 research by CrowdStrike.

Unlike traditional on-premises infrastructure, the public cloud has no defined perimeters. The lack of clear boundaries poses several cybersecurity challenges and risks, especially to more traditional approaches. As more businesses seek hybrid work environments, these boundaries will continue to be blurred. 

Security threats and the vulnerability of the cloud 

One of the key intrusion techniques adversaries have been using is opportunistically exploiting known remote code execution (RCE) vulnerabilities in server software. This involves scanning for vulnerable servers without focusing on particular sectors or regions. Once acquiring initial access, threat actors then deploy a variety of tools to access sensitive data.

Credential-based intrusions against cloud environments are among the more prevalent exploitation vectors used by eCrime and targeted intrusion adversaries. Criminal actors routinely host fake authentication pages to harvest legitimate authentication credentials for cloud services or online webmail accounts.

Actors then use these credentials to attempt to access accounts. For example, Russian cybercrime espionage group Fancy Bear has recently decreased the use of malware and increased the use of credential-harvesting tactics. Experts have found that they have been using both large-scale scanning techniques and even victim-tailored phishing websites that convince the user that a website is legitimate. 

And, despite the use of reduced use of malware as an intrusion technique, some adversaries are still leveraging such services for command and control. They carry this out by using legitimate cloud services to deliver malware.

This tactic is advantageous, as it allows adversaries to evade signature-based detections. This is because many network scanning services typically trust top-level domains of cloud hosting services. Using legitimate cloud services (such as chat) can allow adversaries to evade security controls by blending into normal network traffic. 

Adversaries are using cloud services against businesses