“Exploiting Trust: How Threat Actors Turn Legitimate Software into Cyber Weapons”
**Exploring the Rise of CAMO Attacks: How Hackers Use Legitimate Software to Evade Detection**
In the shadowy corners of cyberspace, a worrying trend has emerged, one that sees cybercriminals turning the tools of everyday digital life against us.
Security researchers at ReliaQuest have recently shed light on a significant rise in the exploitation of legitimate software by threat actors. This method, known as Commercial Applications for Malicious Operations (CAMO), has seen a sharp increase in use, particularly noted from January to August 2024. The findings are alarming: 60% of all critical hands-on-keyboard incidents now involve CAMO, up 16% from the previous year.
The essence of CAMO lies in its stealth. By utilizing widely trusted IT tools such as PDQ Deploy, Total Software Deployment (TSD), and remote monitoring and management (RMM) software like AnyDesk or ScreenConnect, hackers can infiltrate systems undetected. These tools, often equipped with valid code signing certificates, blend seamlessly into normal network traffic, complicating detection efforts. For instance, the Medusa ransomware group has been reported to use PDQ Deploy to disseminate and activate their malicious payloads. Similarly, the Inc Ransom group employs SoftPerfect NetScan for scouting network vulnerabilities and Restic—disguised cunningly as “winupdate.exe”—for siphoning data stealthily.
The challenge with CAMO is its ability to evade standard security policies and mimic legitimate IT operations, making it a formidable tool in a hacker’s arsenal. The Black Basta group, for example, uses RMM tools not just for infiltration but also to establish robust command and control channels through social engineering campaigns.
To combat these CAMO-based threats, a multi-layered defense strategy is essential. Network segmentation through the use of VLANs and DMZs can limit the spread of an attack within an organization. Application whitelisting is another critical measure; tools like Windows Defender Application Control (WDAC) or AppLocker ensure only approved applications run on network systems. Moreover, organizations must enforce strict controls on the use of RMM tools to prevent their misuse.
Beyond these technical defenses, there is a pressing need for heightened awareness about CAMO tactics among cybersecurity teams. Incorporating CAMO scenarios into incident response plans, penetration testing exercises, and risk assessments can prepare organizations to better identify and respond to these threats. Additionally, preventing data exfiltration should be a priority—measures like blocking unauthorized cloud services and monitoring access to sensitive data are vital.
As we look to the future, it’s clear that threat actors will continue to leverage legitimate IT tools for malicious purposes. This trend is not only prevalent in isolated incidents but also discussed openly across cybercriminal forums. Even nation-state actors like “Cozy Bear” are integrating these tactics into more sophisticated custom malware attacks, using platforms like Microsoft OneDrive for data extraction.
This persistent reliance on legitimate software by cybercriminals points to a broader issue within our digital ecosystems—the very tools designed to facilitate efficiency and connectivity can also be turned against us. As we continue to integrate technology into every facet of personal and professional life, the line between use and misuse becomes increasingly blurred. It’s a development that calls for not only advanced technological safeguards but also a fundamental shift in how we perceive and implement cybersecurity measures in an ever-evolving threat landscape.
