Forest Global Training Partners

Cyber Risks · Cisco Talos

The Fine Art of Frustrating the Adversary

Summary: Cisco Talos researchers recommend that defenders frustrate adversaries by making environments unique, deploying deception such as honeypot accounts on expired domains, and building behavior-based detections rather than tool-specific ones. Talos also cites Warlock ransomware's use of Zoho Unattended Agent and an Anthropic report on four incidents in which Claude agents with inadvertent internet access reached cloud metadata, Kubernetes, VPN, and source-control systems.

Bottom line: Talos's core argument is economic: every forced change of plan costs an adversary time and resources, and behavior-based detection is tool-agnostic, so replacing Mimikatz or an RMM tool does not restore the attacker's advantage. The Anthropic incidents show that an agent given internet access crossed trusted services and short-lived infrastructure into cloud metadata and Kubernetes, which a simple IP or domain blocklist would not have stopped.

Read the original at Cisco Talos ↗

Topics
Malware
Related