Attackers Use Automation to Speed from Exploit to Compromise According to Lacework Labs Cloud Threat Report

New open supply Cloud Hunter software, developed via Lacework Labs analysis, helps clients get higher visibility to cut back response instances for incident investigations

SAN JOSE, Calif., Oct. 13, 2022 /PRNewswire/ — Lacework®, the data-driven cloud safety firm, at the moment launched the fourth Lacework Labs Cloud Threat Report and subsequently launched a brand new, open supply software for cloud looking and safety efficacy testing. The new software, referred to as Cloud Hunter, will assist clients hold tempo with ever-improving adversarial tradecraft via superior environmental evaluation and improved incident response time.

Developed in response to new forms of refined menace fashions uncovered via Lacework Labs’ analysis, Cloud Hunter makes use of the Lacework Query Language (LQL) to allow looking throughout knowledge throughout the Lacework platform by the use of dynamically-created LQL queries. Customers can shortly and simply discover knowledge and develop queries for ongoing monitoring as they scale detections together with their group’s cloud safety program. Data is robotically analyzed whereas Cloud Hunter extracts info, additional streamlining the capabilities and response instances for incident investigations.

The Lacework Labs Cloud Threat Report examines the cloud safety menace panorama over the previous three months and unveils the brand new strategies and avenues cybercriminals are exploiting for revenue on the expense of companies. In this newest version, the Lacework Labs group discovered a considerably extra refined attacker panorama, with a rise in assaults in opposition to core networking and virtualization software program, and an unprecedented improve within the pace of assaults following a compromise. Key developments and threats recognized embrace:

• Increased pace from publicity to compromise: Attackers are advancing to hold tempo with cloud adoption and response time. Many courses of assaults are actually totally automated to capitalize on timing. Additionally, one of the vital frequent targets is credential leakage. In a selected instance from the report, a leaked AWS entry key was caught and flagged by AWS in file time. Despite the restricted publicity, an unknown adversary was in a position to login and launch tens of GPU EC2 cases, underscoring simply how shortly attackers can reap the benefits of a single easy mistake.
• Increased concentrate on infrastructure, particularly assaults in opposition to core networking and virtualization software program: Commonly deployed core networking and associated infrastructure persistently stays a key goal for adversaries. Core flaws in infrastructure usually seem abruptly and are shared overtly on-line, creating alternatives for attackers of every kind to exploit these potential targets.
• Continued Log4j reconnaissance and exploitation: Nearly a yr after the preliminary exploit, the Lacework Labs group continues to be generally observing weak software program focused by way of OAST requests. Analysis of Project Discovery (work together.sh) exercise revealed Cloudflare and DigitalOcean as the highest originators.

“Creating an open source tool not only extends our capabilities as a research team and company, but also gives us a way to fully give back to and empower the developer community based on what we’re seeing from our threat research,” stated James Condon, Director of Threat Research at Lacework. “As our research shows an increasingly more sophisticated attack landscape, this tool provides a more detailed analysis of an organization’s unique environment based on the new techniques being leveraged by attackers. Cloud Hunter is the first tool from Lacework to generate queries that can be directly converted into custom policies within a customer’s environment.”

The Lacework Labs group additionally examined points round how “rogue accounts” are utilized by attackers for the reconnaissance and probing of S3 buckets in addition to the rising reputation of cryptojacking and steganography. A full copy of the report and the chief abstract will be discovered right here.

Lacework is the data-driven safety platform for the cloud. The Lacework Cloud Security Platform, powered by Polygraph, automates cloud safety at scale so our clients can innovate with pace and security. Only Lacework can gather, analyze, and precisely correlate knowledge throughout a corporation’s AWS, Azure, GCP, and Kubernetes environments, and slim it down to the handful of safety occasions that matter. Customers all around the globe depend upon Lacework to drive income, carry merchandise to market quicker and safer and consolidate level safety options right into a single platform. Founded in 2015 and headquartered in San Jose, Calif., Lacework is backed by main traders like Sutter Hill Ventures, Altimeter Capital, D1 Capital Partners, Tiger Global Management, Counterpoint Global (Morgan Stanley), Franklin Templeton, Durable Capital, General Catalyst, XN, Coatue, Dragoneer, Liberty Global Ventures, and Snowflake Ventures, amongst others. Get began at www.lacework.com.

Media Contact

Kate Reed

[email protected]

Photo – https://mma.prnewswire.com/media/1874547/Lacework_Logo.jpg 

View unique content material:https://www.prnewswire.co.uk/news-releases/attackers-use-automation-to-speed-from-exploit-to-compromise-according-to-lacework-labs-cloud-threat-report-301648643.html

Source link