TU-SO further elaborated that in the past year “the threat actors accessed the target environment using compromised credentials and the companies’ own virtual private network (VPN) or other remote access solutions.”
The research team also noted that threat actors were “living off the land,” using credentials, systems and tools they collected along the way instead of backdoors. By using a company’s own tools, the threat actors made it difficult for IT security professionals to distinguish adversary activity from that of legitimate users — pushing detection times out to weeks, months, or even years.
