They may send phishing emails, infect users with malware such as key loggers, or gather leaked credentials from credential dumps such as Collection #1 before launching brute force attacks against their targets.īased on Proofpoint research, threat actors continue to evolve their techniques to avoid detection and bypass common security measures.

Threat actors hunt for cloud credentials to improve the efficacy of their attacks. Proofpoint studies attacks against cloud accounts and has identified four distinct stages. Before we reveal how it’s worth reviewing how cloud attacks work. Proofpoint can help organizations detect cloud threats and auto-respond. Protecting these two cloud services from account compromise requires careful layering of threat protection, authentication and data security capabilities along with a people-centric security approach that accounts for who is most attacked, vulnerable to attacks and/or privileged with access to sensitive data. An attacker can also reset passwords to other cloud service accounts when they take over a user’s email account. Office 365 and G Suite accounts are heavily targeted because they hold the key to business communication and valuable data.

Once successful in getting a foothold in a tenant, threat actors move laterally by phishing other members of the organization and its business partners to find an avenue for cyber fraud and data theft.

40% of all tenants have at least one compromised account in their environment as a result of these brute force and phishing-related attacks. Our recent blog post detailing how cybercriminals compromise cloud accounts provides crucial insight into attacks on Microsoft Office 365 and Google G Suite specifically.

Rain on your parade cloud news channel