Living off the land (LotL)
Attack technique that hijacks legitimate OS tools and features to move through a network, without dropping detectable malware.
On May 24, 2023, Microsoft described Volt Typhoon, a China-linked group sitting in US infrastructure networks since mid-2021 without dropping a single piece of malware; a CISA and FBI advisory of February 2024, on other networks, spoke of access kept for at least five years. Living off the land is that family of offensive tactics: the attacker drops no malicious tools on the target and instead abuses binaries, scripts and features already on the system, such as PowerShell, WMI, certutil or PsExec on Windows. The approach gets past signature-based antivirus and EDR, since the processes running are executables signed by the OS vendor. APT groups and some ransomware operators have widely adopted it to stretch out reconnaissance and lateral movement before the attack shows itself. On the defensive side, detection takes fine-grained behavioral analysis rather than simple signature correlation. For cyber insurers, a LotL attack significantly lengthens the attacker's average dwell time in the network. The potential severity of the loss rises with it, particularly on data exfiltration and business interruption.
Textbook case: a forensic investigation following a cyber claim reveals that the attacker spent six weeks inside the network without dropping a single malicious file, using only PowerShell and WMI to move laterally. The SOC detected the incident only at the moment of ransomware deployment. The undetected dwell time widens the scope of compromised data and triples the loss estimate.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.