New threat report reveals 10 minutes from recon to attack

According to a new report from cloud security company Sysdig, the average time from recon to attack completion is now only 10 minutes. 

The 2023 Global Cloud Threat Report breaks down what is lurking in some software supply chains and how automation has been weaponised in the cloud.

Using worldwide honeynets for the 2023 Global Cloud Threat Report, the Sysdig Threat Research Team sheds light on an alarming truth: attacks in the cloud are lightning fast, with minutes determining the line between detection and severe damage. 

It is clear that cloud attackers are taking advantage of the same things that lure companies to the cloud. While defenders need to protect their entire software life cycle, attackers only have to be right one time, and automation is making it even easier for them.

Key findings from the report include:

Cloud automation weaponised. Cloud attacks happen fast. Recon and discovery are even faster. Automating these techniques allows an attacker to act immediately upon finding a gap in the target system. A recon alert is the first indication that something is awry; a discovery alert means that the blue team is too late.

10 minutes to pain. Cloud attackers are quick and opportunistic, spending only 10 minutes to initiate an attack. According to Mandiant, the median dwell time on premises is 16 days, underlining the speed of the cloud.

A 90% safe supply chain isn't safe enough. 10% of advanced supply chain threats are invisible to standard tools. Evasive techniques enable attackers to hide malicious code until the image is deployed. Identifying this type of malware requires runtime analysis.

65% of cloud attacks target telcos and fintech. Telecommunication and finance companies are ripe with valuable information and offer an opportunity to make quick money. Both industries are attractive targets for fraud schemes.

"The reality is, attackers are good at exploiting the cloud," says Michael Clark, Director of Threat Research at Sysdig.

"It is not just that they can script recon and autodeploy cryptominers and other malware, but they take the tools that unleash the power of the cloud for good and turn them into weapons. Abusing infrastructure-as-code to bypass protective policies is one example," he says. 

Alessandro Brucato, a Threat Research Engineer at Sysdig. adds, "Cloud-native attackers are everything-as-code experts and automation fans, significantly reducing their time to impact on the target systems and increasing the potential blast radius.

"Open source detection-as-code approaches like Falco are how blue teams can stay ahead in the cloud."