2024 CrowdStrike Global Threat Report: From breakout to breach in under three minutes; cloud infrastructure under attack

CrowdStrike (Nasdaq: CRWD) today announced the findings of the 2024 CrowdStrike Global Threat Report, highlighting a surge in adversaries leveraging stolen identity credentials to exploit gaps in cloud environments and maximise the stealth, speed and impact of cyber attacks. The report also details the biggest threats on the horizon for 2024, including the disruption of global elections and the exploitation of generative AI to lower the barrier of entry and launch more sophisticated attacks.

In the 10th annual edition of the cyber security leader’s seminal report, CrowdStrike highlights activity from some of the 230+ prolific threat groups that it tracks today. Key findings in the 2024 report include:

• Dramatic increase in attack velocity: The speed of cyber attacks continues to accelerate at an alarming rate. The report indicates that the average breakout time is down to only 62 minutes from 84 in the previous year (with the fastest recorded attack coming in at two minutes and seven seconds). Once initial access was obtained, it took only 31 seconds for an adversary to drop initial discovery tools in an attempt to compromise victims.
• Stealthy attacks spike as adversaries compromise credentials: The report notes a sharp increase in interactive intrusions and hands-on-keyboard activity (60%) as adversaries increasingly exploit stolen credentials to gain initial access at targeted organisations.
• Adversaries follow as business moves to the cloud: Adversaries turned their sights to the cloud through valid credentials – creating a challenge for defenders looking to differentiate between normal and malicious user behaviour. The report shows cloud intrusions increased by 75% overall, with cloud-conscious cases amplifying by 110% year-over-year.
• The exploitation of generative AI on the horizon: In 2023, CrowdStrike observed nation-state actors and hacktivists experimenting with and seeking to abuse generative AI to democratise attacks and lower the barrier of entry for more sophisticated operations. The report highlights how generative AI will likely be used for cyber activities in 2024 as the technology continues to gain popularity.
• Disrupting democracy by targeting global elections: With more than 40 democratic elections scheduled in 2024, nation-state and eCrime adversaries will have numerous opportunities to disrupt the electoral process or sway voter opinion. Nation-state actors from China, Russia and Iran are highly likely to conduct misinformation or disinformation operations to sow disruption against the backdrop of geoconflicts and global elections.

“Over the course of 2023, CrowdStrike observed unprecedented stealthy operations from brazen eCrime groups, sophisticated nation-state actors and hacktivists targeting businesses in every sector spanning the globe. Rapidly evolving adversary tradecraft honed in on both cloud and identity with unheard of speed, while threat groups continued to experiment with new technologies, like GenAI, to increase the success and tempo of their malicious operations,” said Adam Meyers, head of Counter Adversary Operations, CrowdStrike. “To defeat relentless adversaries, organisations must embrace a platform approach, fuelled by threat intelligence and hunting, to protect identity, prioritise cloud protection and give comprehensive visibility into areas of enterprise risk.”

As the cyber security consolidator in the AI era, CrowdStrike pioneered the adversary-focused approach to cyber security and provides customers with adversary-driven intelligence, human-led analysis and the groundbreaking technology required to stay ahead of threats. This unique approach combines the unparalleled power of CrowdStrike Falcon Intelligence with CrowdStrike Falcon OverWatch’s elite team of threat hunters to fuel the AI-native CrowdStrike XDR Falcon platform to accelerate investigations, remediate threats and ultimately stop breaches.

Additional resources

• Download the 2024 CrowdStrike Global Threat Report.
• To learn more about CAO’s new modules, please visit our website.
• Visit CrowdStrike’s Adversary Universe for the internet’s definitive source on adversaries.
• Listen to the Adversary Universe podcast to glean insights into threat actors and recommendations for bolstering security.