Clouds in the forecast: CrowdStrike cloud risk report
summary
CrowdStrike reports rapid cloud attacks: median lateral movement takes 84-minute breakout, cloud exploitation rises 95% and cloud‑conscious adversaries triple. Observed specifics: 112% jump in cloud access broker activity, 43% of intrusions use valid accounts, 67% show IAM role escalation, 28% delete instances, 60% of containers misconfigured. Examples show attackers using kURL and sliver implant, querying IMDS to harvest credentials and persisting via cron. Recommended defenses: Falcon CSPM and runtime sensor, IMDSv2, image scanning, CIEM for least‑privilege and automated patching.
AI-written summary · about
chapters (10)
- 0:00Intro
- 3:13Cloud exploitation is on the rise
- 3:44Cloud-conscious adversaries
- 4:22Adversaries are sharpening their cloud TTPs
- 5:50Human error and default cloud provider settings drives cloud risk
- 8:34Adversary deploys sliver implant and targets cloud credentials
- 16:15How CrowdStrike can help stop this attack
- 20:54Panda explores Linux and cloud workloads
- 30:44Threat actor gains access to a cloud-hosted Windows server
- 41:11Complimentary cloud security risk review
related talks
50mInsights into New Supply Chain and Cloud-Identity Attacks
47m3 steps to help mitigate cloud risks
18mSecuring cloud innovation: Lessons learned
56mUnify cloud security from code to runtime with CrowdStrike and Bionic
50mAvoiding cloud security anti-patterns the right way
58mOutpacing threats w/ CrowdStrike, Anthropic Claude & Amazon Bedrock
31mCloud Threat Landscape - 2021
48mLateral Movement in the Age of Hybrid Cloud