Overall, the firm’s metrics reveal a rise in state-sponsored and cybercrime adversaries exploiting legitimate credentials and identities to evade detection and bypass legacy security controls. Also:

• North Korea threat groups posed as legitimate US employees: Over 100 primarily-US technology firms had been infiltrated using falsified or stolen identity documents and insiders to gain employment as remote IT personnel to exfiltrate data and carry out malicious activity.
• Hands-on-Keyboard intrusions had increased by 55%: More threat actors had been engaging in such activities to blend in as legitimate users and bypass legacy security controls, with 86% executed by adversaries seeking financial gains. The increases in such attacks in healthcare (7%) and technology (60%) customers has rendered them the most targeted sectors in the cybersecurity firm’s metrics for the seventh year in a row. Adversaries including Chef Spider and Static Kitten (Iran-nexus) had been using legitimate remote monitoring and management tools for endpoint exploitation, accounting for 27% of all hands-on-keyboard intrusions.
• Cross-domain attacks have persisted: Threat actors have been increasingly exploiting valid credentials in order to breach cloud environments and eventually using that access to attack endpoints with minimal footprints in each affected domain.
• Cloud adversaries targeted the control plane: Cloud-conscious adversaries such as Scattered Spider have been leveraging social engineering, policy changes, and password manager access to infiltrate cloud environments and exploiting connections between the cloud control plane and endpoints to move laterally, maintain persistence, and exfiltrate data.