Insecure configurations put small businesses at increased risk and Log4j-based malware attacks persist

SAN JOSE, Calif., March 29, 2022 /PRNewswire/ -- Lacework®, the data-driven cloud security company, today released the third volume of its Cloud Threat Report, a semi-annual accounting of the ongoing cybersecurity threats impacting the cloud. Conducted over a six month period, the Cloud Threat Report found threat actors are broadening the scope of their efforts to gain illicit access to cloud data and resources. In addition to increased targeting of cloud platforms beyond AWS, Microsoft Azure, and Google Cloud, malicious actors are rapidly adapting new attacks to target organizations in the cloud. As world governments issue warnings over the increasing cybercrime threat, the report's findings highlight some of the most common threats businesses should protect against.

Small businesses in particular are at risk from cloud access brokers, who sell access to cloud accounts online. According to the report, 78 percent of SMBs observed by the Lacework Labs team had compliance violations within their cloud infrastructure, opening the door for attackers to gain initial access, escalate privileges, and impact protected data.

"Threat actors continue to show sophistication as they create and adapt new attacks to compromise the cloud," said James Condon, Director of Research, Lacework. "Organizations moving more data to cloud infrastructure need to be just as nimble, employing security best practices and modern tools with continuous monitoring to stay ahead of cybercriminals and keep critical information safe."

This third installment of the Cloud Threat Report highlights four key areas of cloud security: cloud security posture, vulnerabilities and software supply chain, runtime threats and linux malware, and proactive defense and intelligence. Based on anonymized data across the Lacework platform from September 2021 - February 2022, the report found:

• Cloud security posture mistakes are an open door for threat actors: 72 percent of cloud environments monitored had insecure configurations, providing a warm welcome for attackers to gain initial access, establish persistence, escalate privileges, and impact protected data across clouds. The most common risks were found in the AWS services IAM, S3, and EC2, which were also the most popular services for attackers to abuse.
• Every cloud is a target, not just the big 3: Despite being one of the largest cloud services providers, AWS accounts make up only 16% of overall hosting of illicit access for sale, while lesser known companies like HostGator and Bluehost make up half. Though corporate accounts are being offered for as low as $300 USD and upwards of $30k USD, the average price of a compromised AWS account is roughly $40 USD. This high volume of lower priced inventory indicates that attackers may be taking advantage of the increased compliance violations in SMB organizations and a lack of focus on securing consumer accounts.
• Log4j remains a significant threat, and malware is adapting quickly: 31 percent of malware infections observed by the Labs team use Log4j as the initial infection vector. What's more, Muhstick, the malware family most commonly observed in the wild, can incorporate vulnerabilities like Log4j into their operations within 48 hours, reinforcing how quickly threat actors will respond to take advantage of vulnerability disclosures.

The Lacework Labs team also examined issues around compliance, exposed Docker APIs and malicious containers, and additional vulnerabilities within the software supply chain. A full copy of the report and the executive summary can be found here.

Based on the findings of this report, Lacework Labs recommends that defenders evaluate security infrastructure against industry best practices and implement proactive defense and intelligence tools with active vulnerability monitoring like the Polygraph® Data Platform. The Lacework Labs team has put together several resource guides organizations can use to set up canary tokens, honeypots, and other proactive tools on the Lacework blog.

Additional Resources:

• For more information about Lacework Labs, including links to past Cloud Threat Reports, visit our website.
• Check out our blog to learn more about Lacework and what's happening across the security industry.
• Become an expert on security fundamentals and learn more from your security and developer peers through Lacework Academy and the Lacework Community.
• Read what our customers have to say about the Lacework Polygraph Data Platform.
• For more information about how to join the Lacework team, visit our careers page.

About Lacework
Lacework is the data-driven security company for the cloud. The Lacework Polygraph Data Platform automates cloud security at scale so our customers can innovate with speed and safety. Only Lacework can collect, analyze, and accurately correlate data across an organization's AWS, Microsoft Azure, Google Cloud, and Kubernetes environments, and narrow it down to the handful of security events that matter. Customers all over the globe depend on Lacework to drive revenue, bring products to market faster and safer, and consolidate point security solutions into a single platform. Founded in 2015 and headquartered in San Jose, Calif., Lacework is backed by leading investors like Sutter Hill Ventures, Altimeter Capital, D1 Capital Partners, Tiger Global Management, Counterpoint Global (Morgan Stanley), Franklin Templeton, Durable Capital, GV, General Catalyst, XN, Coatue, Dragoneer, Liberty Global Ventures, and Snowflake Ventures, among others. Get started at www.lacework.com.

Contact: Inkhouse PR, Danielle Vincent, lacework@inkhouse.com