Cado Security, provider of the first cloud forensics and incident response platform, today announced the release of the Cado Security Labs H2 2023 Cloud Threat Findings Report, sharing deep insights into the cloud threat landscape to help security teams remain at the forefront of securing their organizations against the latest threats.
Cado Security Labs operates honeypot infrastructure across four distinct geographical regions to collect cloud attacker telemetry. The latter half of 2023 saw the introduction of “Cloudypots,” a new, more sophisticated, high-interaction honeypot system that allows researchers to honeypot accurate services quickly and safely.
As commercial adoption of cloud technologies continues, cloud-focused malware campaigns have increased in sophistication and number – a collective effort to safeguard both large and small enterprises is critical. Security teams need to reassess their internal tools and approaches to ensure their ability to correctly identify, investigate, and respond to emerging cloud threats.
The report provides insights into the second half of 2023, an analysis of real-world techniques employed by attackers, an overview of novel malware campaigns found in the wild targeting cloud environments, including Qubitstrike, Legion, Blackcat, Bioset, Cetus, P2Pinfect, and 9hits.
Key technical findings from attacker telemetry, which Cado Security covers in detail within the report, include:
- Attackers target cloud services that require specialist technical knowledge to exploit. Attackers are increasingly targeting services, such as Docker, Redis, Kubernetes, and Jupyter, that require expert technical knowledge to exploit, different from what’s required for attacking generic Linux servers.
- Docker is the most commonly exploited “cloud-native” service for initial access. Although cloud-focused attackers aim to exploit various services typically deployed in cloud environments, Docker remains the most frequently targeted for initial access, with 90.65% of honeypot traffic when discounting SSH.
- Threat actors leverage hosting companies across the globe for their infrastructure. Identified malware campaigns, such as P2Pinfect, had a wide geographical distribution with nodes belonging to providers in China, the US, and Germany, which shows that regardless of where your infrastructure is located, it is still susceptible to Linux and cloud-focused attacks.
- Cryptojacking is no longer the sole focus of cloud attackers. While cryptojacking is a legitimate and significant threat, Cado Security Labs has started to see a diversification in objectives displayed by recent Linux and cloud malware campaigns. For example, with the discovery of new Linux variants of ransomware families, such as Abyss Locker, there is a worrying trend of ransomware on Linux and ESXi systems. Cloud and Linux infrastructure is now subject to a broader variety of attacks.
Other observations also include:
- Attackers continue to exploit web-facing services in cloud environments to help them gain access to cloud environments and invest significant time into hunting for misconfigured deployments of these services.
- Rust malware continues to increase as the language gains popularity in general software development and will also become increasingly popular in the malware community, with threat actors increasingly developing malicious payloads in Rust.
To ensure effective and efficient cloud incident handling, Cado Security Labs recommends that security teams establish a policy of regularly reviewing the security of deployed services in their cloud estate, reduce the attack surface by only deploying public-facing services when necessary, and use networking security features provided by their Cloud Service Provider (CSP), collect and aggregate logs from CSP’s control plane and for the individual services intended to run in their accounts, and hold a periodic review and automated alerting for anomalies found in these log sources.
To download the full report, visit https://offers.cadosecurity.com/h2-2023-threat-findings-report.
Martello Joins Forces with Yorktel to Bring Vantage DX to Microsoft Teams Managed Service
Posted in Commentary with tags Martello on February 28, 2024 by itnerdMartello Technologies Group Inc., a provider of experience management solutions purpose-built for Microsoft Teams, today announced a partnership with leading managed services provider Yorktel. The collaboration will bring Vantage DX to customers through Yorktel’s Modern Workplace as a Service (MWaaS) offering. Vantage DX is the Microsoft-recommended software that proactively detects problems before they impact Microsoft Teams users, providing tools to resolve these problems faster and optimize the Teams user experience.
A Microsoft Operator Connect partner headquartered in the United States, Yorktel is a leading provider of collaboration and managed service solutions for enterprise, public sector, education and healthcare customers worldwide. Committed to addressing hybrid workplace challenges, Yorktel has chosen Vantage DX for its MWaaS offering, to proactively manage the Microsoft Teams performance and user experience for its customers, maximizing uptime and productivity.
The partnership has already yielded a sales deal with a large North American multinational investment management firm with more than 40 locations globally to manage the Teams user experience for 5,000 employees in the US and Canada. This project also supported a major Federal Department requiring strict security provisions. With Microsoft Teams a mission-critical part of Yorktel’s offering, they expect to integrate Vantage DX into all new deployments.
Microsoft Teams experience management has become a pressing concern for enterprises and managed service providers. The recent State of Microsoft 365 Performance Management report produced by research firm EMA exposed an important blind spot for enterprise IT teams. While 81% of Teams users cited Teams performance issues such as poor video or audio quality as having a high or significant impact on their productivity, only 7% of IT teams said they had an accurate view of how Microsoft Teams is performing for users. Vantage DX closes this visibility gap for enterprises and managed service providers.
Interested in learning more about Martello’s Microsoft-recommended Vantage DX solution for Microsoft Teams? Read about Martello’s Partner Program and about Vantage DX.
Leave a comment »