Table of
Contents
Introduction 3
Naming Conventions 6
Front-Line Snapshot 7
Sector Targeting 9
Sector Spotlights 10
Intrusion Trends by Adversary 12
Observations from the Front Lines 15
Hunting the Cross-Domain Threat 15
Case Study: SCATTERED SPIDER Abuses Cloud
Management Agent to Establish Persistence 16
Hunting the Insider Threat 18
Case Study: FAMOUS CHOLLIMA Insider Threats Target
100+ U.S.-Based Companies 19
Identity Hunting 22
Case Study: HORDE PANDA Activity 24
Cloud Hunting 26
Case Study: Adversaries Pivot Between Cloud Control
Plane and Hosted VMs 27
Case Study: Threat Actor Enumerates Cloud Account
Information from Compromised VMs 28
Endpoint Hunting 31
Case Study: Hunting the STATIC KITTEN Adversary 33
Countering the Adversary 36
Case Study: Hunting PUNK SPIDER 37
Conclusion 39
About CrowdStrike 41