Insights into New Supply Chain and Cloud-Identity Attacks
summary
Adversaries cut breakout time to about 84 minutes (top 30% under 30), access broker listings jump ~112%, and cloud exploitation rises ~95% year over year. Demonstrated chains include Apache RCE via Metasploit, running MimiPenguin to dump credentials, using AWS CLI and IMDS calls to list S3, disabling bucket logging and copying confidential files, plus Sliver implant + cron for persistence. Defenses shown tie image scanning in CI/CD, runtime sensors (CWP) and CSPM control‑plane alerts to detect and remediate these actions.
AI-written summary · about
chapters (8)
- 0:00Start
- 4:10Interactive Intrusions Gained Speed
- 4:43The data, tools, and teams behind CrowdStrike Intelligence
- 6:39Developing Ecosystems of Access
- 12:43Cloud Attack Chain
- 18:38Unidentified Adversary Deploy Sliver Implant and Targets Cloud Credentials
- 21:16Hiding in the Shadows: A story of lateral movement
- 34:59Best Practices to Secure Your Cloud
related talks
43mClouds in the forecast: CrowdStrike cloud risk report
18mSecuring cloud innovation: Lessons learned
46mStories from the cutting edge: Cloud security in 2023
16mLessons from the SOC: Analyzing and remediating cloud attack paths
50mThe Anatomy of Cloud Attacks
26mSupply chain security - develop quickly without inviting The Nefarious
56mUnify cloud security from code to runtime with CrowdStrike and Bionic
51mThe Enemy Within: Modern Supply Chain Attacks