Elastic Global Threat Report 2023: Top cybersecurity forecasts and recommendations

Adversaries will become more reliant on open-source communities for implants, tools, and infrastructure.

Cyber attackers are increasingly using commercial and open-source tools to compromise systems across different platforms. Tools such as Metasploit, Cobalt Strike, and Sliver framework are commonly used by threat groups to target Windows, Linux, and macOS devices. There is also a growing trend of malware-as-a-service and ransomware campaigns that use these tools to launch attacks. The attackers may be using open-source tools to reduce their operational costs.

Cloud credential exposure will be a primary source of data exposure incidents.

Attackers often use Credential Access techniques to gain access to data or systems. Credential Access is a broad term that includes passwords, tokens, and other authentication methods. We observed that about 7% of all endpoint behavior signals were related to this tactic, and 79% of them involved dumping credentials from the operating system using built-in tools or features.

For cloud service providers (CSPs), Credential Access accounted for about 45% of all detection signals. For AWS, these signals mainly involved unusual attempts to access secrets from Secrets Manager, environment variables from local EC2 hosts, and credential files. Credentials can also be leaked through code repositories, such as GitHub, if the code is not properly reviewed or cleaned.

Defense evasion is going to remain the top investment, and tampering will supersede masquerading.

The high prevalence of Defense Evasion techniques suggests that attackers are well-aware of the monitoring tools and security solutions in place and are developing strategies to work around them. This is a clear sign that adversaries are adapting to hostile environments and that they're investing time and resources to ensure their malicious activities remain under the radar.