It’s 3:37 am on a Sunday in Los Angeles, and one of the leading financial services firms on the West Coast is experiencing the second week of a<a href="https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/living-off-the-land-attack/"> living-off-the-land (LOTL) attack</a>. A nation-state cyberattack squad has targeted the firm’s pricing, trading and valuation algorithms for cryptocurrency gain. Using common tools, the nation state has penetrated the firm’s infrastructure and is slowly weaponizing it for its own gain.According to <a href="https://www.crowdstrike.com/en-us/">CrowdStrike’s</a><a href="https://www.crowdstrike.com/en-us/global-threat-report/"> 2025 Global Threat Report</a>, nearly 80% of modern attacks, including those in finance, are now malware-free, relying on adversaries exploiting valid credentials, remote monitoring tools and administrative utilities with breakout times (sometimes less than a minute).No one in the SOC or across the cybersecurity leadership team suspects anything is wrong. But there are unmistakable signals that an attack is underway. The upsurge in credential theft, business email compromise and exploit of zero-day vulnerabilities is creating the ideal conditions for LOTL attacks to proliferate. <a href="https://www.bitdefender.com/en-us/">Bitdefender’s</a> <a href="https://www.bitdefender.com/content/dam/bitdefender/business/campaign/assessment/Official-2025-Cybersecurity-Assessment-Report.pdf">recent research</a> found that 84% of modern attacks use LOTL techniques, bypassing traditional detection systems. In nearly <a href="https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report">1 in 5 cases</a>, attackers increasingly aided by automation and streamlined toolkits exfiltrated sensitive data within the first hour of compromise. LOTL-based tactics now account for the majority of modern cyber intrusions, with advanced persistent threats (APTs) often lingering undetected for weeks or months before hackers exfiltrate valuable data, according to<a href="https://www.ibm.com/thought-leadership/institute-business-value/en-us/report/2025-threat-intelligence-index"> IBM’s X-Force 2025 Threat Intelligence Index.</a>The financial repercussions are staggering. CrowdStrike’s 2025 threat research puts the average cost of ransomware-related downtime at $1.7 million per incident, which can balloon to $2.5 million in the public sector. For industry leaders, the stakes are so high that security budgets now rival those of core profit centers.<h2>Your most trusted tools are an attacker’s arsenal </h2>&quot;These are the tools that you cannot disable because your administrators are using them, your applications are using them, your [employees] are using them, but <a href="https://www.bankinfosecurity.com/cyberattackers-love-living-off-the-land-a-28154#dynamic-popup">attackers</a> [are using them, too],&quot; Martin Zugec, technical solutions director at <a href="https://www.bitdefender.com/en-us/">Bitdefender</a>, said at RSAC-2025 earlier this year. &quot;You cannot disable them because you will impact the business.&quot;CrowdStrike’s 2025 report confirms that adversaries routinely exploit utilities such as PowerShell, Windows management instrumentation (WMI), PsExec, remote desktop protocol (RDP), Microsoft Quick Assist, Certutil, Bitsadmin, MSBuild and more to persist inside enterprises and evade detection. LOTL tools of the trade leave no digital exhaust, making it extremely difficult to spot an attack in progress.“<a href="https://venturebeat.com/security/fortanix-and-nvidia-partner-on-ai-security-platform-for-highly-regulated">Threat actors</a> increasingly exploit techniques such as bring your own vulnerable driver (BYOVD) and LOTL to disable endpoint detection and response (EDR) agents and conceal malicious activity within legitimate system operations,&quot; Gartner notes in a <a href="notes Gartner in their recent report, Effective Strategies to Mitigate Attacks on Endpoint Detection and Response (EDR). ">recent report</a>. &quot;By leveraging common OS tools, such as PowerShell, MSHTA and Certutil, they complicate detection and hide in the noise of EDR alerts.&quot;<a href="https://go.crowdstrike.com/State-of-Ransomware-Survey.html">CrowdStrike’s ransomware survey</a> reveals that 31% of ransomware incidents begin with the misuse of legitimate remote monitoring and management tools, proving that even enterprise IT utilities are rapidly weaponized by attackers. The documented realities in CrowdStrike&#x27;s reports corroborate the industry&#x27;s deeper research: The IT stack itself is now the attack vector, and those relying on <a href="https://venturebeat.com/ai/when-your-ai-browser-becomes-your-enemy-the-comet-security-disaster">traditional controls</a> and signature-based detection are dangerously behind the curve.<h2>Behavioral clues hiding in plain sight</h2>Adversaries who rely on LOTL techniques are notorious for their patience.Attacks that once required malware and attention-grabbing exploits have given way to a new norm: Adversaries blending into the background, using the very administrative and remote management tools <a href="https://venturebeat.com/security/agentic-ai-security-breaches-are-coming-7-ways-to-make-sure-its-not-your">security teams depend on</a>. As Bitdefender&#x27;s Zugec <a href="https://www.bankinfosecurity.com/cyberattackers-love-living-off-the-land-a-28154#dynamic-popup">pointed out</a>: “We are mostly seeing that the playbook attackers use works so well they just repeat it at scale. They don’t break in, they log in. They don’t use new malware. They just use the tools that already exist on the network.” Zugec described a textbook LOTL breach: No malware, no new tools. BitLocker, PowerShell, common admin scripts; everything looked routine until the files were gone and no one could trace it back. That’s where threat actors are winning today.Adversaries are using normality as their camouflage. Many of the admins’ most trusted and used tools are the very reason LOTL attacks have scaled so quickly and quietly. Zugec is brutally honest: “It has never been as easy to get inside the network as it is right now.” What was once a breach of perimeter is now a breach by familiarity, invisible to legacy tools and indistinguishable from routine administration.CrowdStrike’s <a href="https://www.crowdstrike.com/en-us/global-threat-report/">2025 Global Threat Report</a> captures the scale of this phenomenon in numbers that should command every board’s attention. The reports’ authors write: “In 2024, 79% of detections CrowdStrike observed were malware-free [a significant rise from 40% in 2019], indicating adversaries are instead using hands-on-keyboard techniques that blend in with legitimate user activity and impede detection. This shift toward malware-free attack techniques has been a defining trend over the past five years.&quot;The report’s researchers also found that breakout times for successful attacks continue to shrink; the average is just 48 minutes, the fastest 51 seconds.Zugec’s advice for defenders working in this new paradigm is blunt and pragmatic. “Instead of just chasing something else, figure out how we can take all these capabilities that we have, all these technologies, and make them work together and fuel each other.” The first step: “Understanding your attack surface. Just getting familiar with how the attackers operate, what they do, not five weeks ago, but right now, should be the first step.” He urges teams to learn what normal looks like inside their own environment and use this baseline to spot what’s truly out of place, so defenders stop chasing endless alerts and start responding only when it matters.<h2>Take complete ownership of your tech stack now </h2>LOTL attacks don’t just exploit trusted tools and infrastructures, they take advantage of an organizations’ culture and daily ability to compete. Staying secure means making constant vigilance a core value, backed by zero trust and microsegmentation as cultural anchors. These are just the first steps. Consider the <a href="https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf">NIST Zero Trust Architecture (SP 800-207) </a>as an organizational backbone and playbook to tackle LOTL head-on: <ul><li>Limit privileges now on all accounts and delete long-standing accounts for contractors that haven’t been used in years: Apply least-privilege access across all admin and user accounts to stop attackers from escalating.</li><li>Enforce microsegmentation: Divide your network into secure zones; this will help confine attackers, limit movement and shrink the blast radius if something goes wrong.</li><li>Harden tool access and audit who is using them: Restrict, monitor and log PowerShell, WMI and other utilities. Use code signing, constrained language modes and limit access to trusted personnel.</li><li>Adopt NIST zero trust principles: Continuously verify identity, device hygiene and access context as outlined in SP 800-207, making adaptive trust the default.</li><li>Centralize behavioral analytics and logging: Use extended monitoring to flag unusual activities with system tools before an incident escalates.</li><li>Deploy adaptive detection if you have an existing platform that can scale and provide this at a minimal charge: Employ EDR/XDR to hunt for suspicious patterns, especially when attackers use legitimate tools in ways that sidestep traditional alerting. </li><li>Red team regularly: Actively test defenses with simulated attacks and know how adversaries misuse trusted tools to penetrate routine security.</li><li>Elevate security awareness and make it muscle memory: Train users and admins on LOTL methods, social engineering and what subtle signals betray compromise.</li><li>Update and inventory: Maintain application inventories, patch known vulnerabilities and conduct frequent security audits.</li></ul>Bottom line: The financial services firm referenced at the beginning of this story eventually recovered from its LOTL attack. Today, their models, the CI/CD process for AI development and gen AI R&amp;D are managed by a team of cybersecurity managers with decades of experience locking down U.S. Department of Defense sites and vaults. LOTL attacks are real, growing, lethal and require a new mindset by everyone in cybersecurity.

تسلط هجمة إلكترونية حديثة على إحدى الشركات الرائدة في الخدمات المالية في لوس أنجلوس الضوء على اتجاه مقلق في الأمن السيبراني، حيث تتجنب 84% من الهجمات الكشف من خلال استغلال أدوات موثوقة. تستهدف هذه الهجمة المعروفة باسم living-off-the-land (LOTL)، والتي تُنسب إلى جهة حكومية، خوارزميات حاسمة لتحقيق مكاسب من العملات المشفرة، مما يثير القلق بشأن الثغرات في البنى التحتية الأكثر أمانًا. يعد فهم هذه التكتيكات أمرًا حيويًا للمنظمات لتعزيز دفاعاتها وحماية البيانات الحساسة.

Un reciente ciberataque a una importante firma de servicios financieros en Los Ángeles destaca una tendencia preocupante en ciberseguridad, donde el 84% de los ataques evaden la detección al explotar herramientas de confianza. Este ataque living-off-the-land (LOTL), atribuido a un actor estatal, tiene como objetivo algoritmos críticos para obtener ganancias en criptomonedas, lo que genera alarmas sobre las vulnerabilidades en infraestructuras supuestamente seguras. Comprender estas tácticas es crucial para que las organizaciones fortalezcan sus defensas y protejan datos sensibles.

Une récente cyberattaque contre une grande entreprise de services financiers à Los Angeles met en lumière une tendance inquiétante en matière de cybersécurité, où 84 % des attaques échappent à la détection en exploitant des outils de confiance. Cette attaque living-off-the-land (LOTL), attribuée à un acteur étatique, cible des algorithmes critiques pour des gains en cryptomonnaie, suscitant des inquiétudes quant aux vulnérabilités même dans les infrastructures les plus sécurisées. Comprendre ces tactiques est crucial pour les organisations afin de renforcer leurs défenses et protéger des données sensibles.

A recent cyberattack on a leading financial services firm in Los Angeles highlights a troubling trend in cybersecurity, where 84% of attacks evade detection by exploiting trusted tools. This living-off-the-land (LOTL) attack, attributed to a nation-state actor, targets critical algorithms for cryptocurrency gain, raising alarms about the vulnerabilities in even the most secure infrastructures. Understanding these tactics is crucial for organizations to bolster their defenses and protect sensitive data.

Your IT stack is the enemy: How 84% of attacks evade detection by turning trusted tools against you

Three councils in London have been affected by a cyberattack that’s disrupted their services and forced them to activate emergency plans.

تأثرت ثلاث مجالس في لندن بهجوم إلكتروني، مما أدى إلى تعطيل كبير في خدماتها واضطر إلى تفعيل خطط الطوارئ. يبرز هذا الحادث تزايد ضعف المؤسسات العامة أمام التهديدات الإلكترونية.

Tres consejos en Londres han sido afectados por un ciberataque, lo que ha llevado a interrupciones significativas en sus servicios y ha obligado a activar planes de emergencia. Este incidente subraya la creciente vulnerabilidad de las instituciones públicas ante las amenazas cibernéticas.

Trois conseils à Londres ont été touchés par une cyberattaque, entraînant des perturbations significatives de leurs services et obligeant à activer des plans d'urgence. Cet incident souligne la vulnérabilité croissante des institutions publiques face aux menaces cybernétiques.

Three councils in London have been impacted by a cyberattack, leading to significant disruptions in their services and prompting the activation of emergency plans. This incident underscores the increasing vulnerability of public institutions to cyber threats.

Your IT stack is the enemy: How 84% of attacks evade detection by turning trusted tools against you

Was this article worth reading? Share it

ThreatWatch360

Flawatch

Cloudalizr