In an era where cybersecurity threats continuously evolve, organizations face many challenges to secure digital assets. Among these threats, a sophisticated and stealthy approach known as Living Off the Land (LotL) attacks has emerged, leaving a minimal footprint and often evading traditional security measures.
This article discusses Living Off the Land attacks, highlighting real-world case studies from notorious APTs, and offering suggestions on how organizations can address these threats.
What Is “Living off the Land” in Cybersecurity?
“Living off the land” (LotL) describes a strategy employed by attackers where they utilize the tools, software, and resources already available on the target system for malicious purposes rather than deploying outside malware that may be detected.
LotL tactics typically have a few core features:
- Utilizing Built-in Tools and Features: Attackers leverage existing, legitimate tools and features the operating system provides to carry out their activities. Standard tools misused include PowerShell, Windows Management Instrumentation (WMI), and various system administration tools.
- Reduced Detection: Since the attackers are using legitimate tools that are supposed to be on the system, their activities are more challenging to detect. Unlike malware or foreign tools, which security solutions could flag, the misuse of legitimate tools often goes unnoticed.
- Scripting and Automation: Attackers often use scripts and automation to carry out malicious activities using the existing tools on the system. This could also include using macros and scripts in office documents to execute malicious commands.
- Fileless Attacks: “Living off the land” tactics often align with fileless attack methodologies, where the attack is carried out in memory, without writing any files to disk, further reducing the footprint and increasing the chances of evading detection.
- Dual-use Tools: Attackers may also utilize dual-use tools, which have legitimate uses but can also be used maliciously. Examples include remote administration tools or network scanning utilities.
- Reduced Attribution: It can be more difficult to attribute attacks carried out using “living off the land” tactics since the attackers are not deploying unique malware that could be tied back to them.
- Resource Efficiency: By using the existing resources on the target system, attackers can save time and effort in developing and deploying their tools or malware.
Who Uses Living of the Land Techniques?
The technique of “living off the land” (LotL) is used by various attackers, particularly those involved in targeted and sophisticated cyber-attacks.
Various targeted attack groups have been seen utilizing LotL tactics. This approach allows them to blend their malicious activity with legitimate administrative work on the target system, making their operations harder to detect and attribute.
A report by CrowdStrike mentioned that 62% of attackers used LotL tools or techniques in their attacks, indicating a widespread adoption of this strategy among cyber attackers. Additionally, specific threat actors like the Volt Typhoon have been reported to focus heavily on LotL techniques to maintain stealth while targeting critical infrastructure in the United States.
Examples Where LotL Techniques Were Used
Volt Typhoon
Volt Typhoon, a state-sponsored cyber actor associated with the People’s Republic of China, utilized LotL techniques extensively in its cyber operations. The actor leveraged built-in network administration tools on target systems to perform its objectives. This approach helped the actor to evade detection by blending in with regular Windows system and network activities, avoiding endpoint detection and response (EDR) products that would alert on the introduction of third-party applications, and limiting the amount of activity captured in default logging configurations.
Some of the built-in tools used by Volt Typhoon include wmic, ntdsutil, netsh, and PowerShell.
APT29
APT29 is known for using stealthy backdoors like POSHSPY, which leverages built-in Windows features such as PowerShell and Windows Management Instrumentation. POSHSPY extensively used WMI to store and persist the backdoor code, making it invisible to non-experts in WMI.
The backdoor ensured that only legitimate system processes were utilized by PowerShell, and malicious code execution could only be identified through enhanced logging or in memory. APT29 deployed POSHSPY as a failover backdoor if they lost access to their primary backdoors.
Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015. The methodology adopted by APT29 for this backdoor exemplifies a fileless approach, making identifying the backdoor much more challenging using standard host analysis techniques.
How You Can Recognize and Address LotL Techniques
Recognizing and mitigating Living Off the Land (LotL) techniques can be challenging due to their inherent nature of blending with legitimate activities.
However, organizations can adopt a multi-faceted approach to deal with such threats effectively:
- Enhanced Logging and Monitoring: Enable and configure advanced logging mechanisms to capture detailed system and network activities. Monitor system logs for unusual behavior patterns, especially focusing on the misuse of built-in tools like PowerShell, WMI, and others. Utilize security information and event management (SIEM) systems to correlate data and identify suspicious activities.
- Behavioral Analysis: Employ tools that identify abnormal patterns based on historical data and known benign behavior. Monitor for unexpected, high-volume command-line or script activity, especially during odd hours.
- Endpoint Detection and Response (EDR) Tools: Implement EDR tools to monitor endpoints for suspicious activities, including the misuse of legitimate tools and scripts. Some EDR solutions can identify malicious activities by analyzing the behaviors and context in which built-in tools are used.
- Educate and Train Staff: Educate staff on the risks associated with LotL techniques and train them to recognize potential signs of misuse. Encourage reporting of unusual system behavior and provide clear reporting channels.
- Regular Auditing and Review: Review system and network configurations to ensure they adhere to best practices. Audit user accounts and privileges to ensure that only necessary permissions are granted.
- Application Whitelisting: Implement whitelisting to control the execution of scripts and applications on the network. This can help prevent the execution of malicious scripts, even if they are leveraging built-in tools.
- Threat Hunting: Engage in proactive threat hunting to identify signs of LotL techniques before they can cause significant damage. Utilize threat intelligence feeds to stay updated on new LotL techniques and indicators of compromise (IoCs).
- External Assistance: Consult with external cybersecurity experts or firms that identify and mitigate LotL techniques. Participate in information sharing and analysis centers (ISACs) to share and receive threat intelligence related to LotL techniques.
- Patch Management: Keep systems, applications, and security solutions up to date to minimize vulnerabilities that could be exploited using LotL techniques.
- Zero Trust Architecture: Adopt a Zero Trust architecture that requires verification at every step, regardless of whether the activity appears to be originating from within the network. Combining these measures can significantly enhance an organization’s ability to recognize and mitigate the risks associated with Living Off the Land techniques.
Monitor and Assess Your IT System with Lazarus Alliance
Living off the land attacks epitomize the stealth and sophistication that modern-day cyber adversaries employ to infiltrate and persist within target networks. These attacks exploit the very tools and features intended to manage and safeguard our digital environments. That’s why having a partner like Lazarus Alliance is essential to help manage and monitor your critical IT infrastructure.
What Is Autonomous Malware?
We’re reaching the end of 2025, and looking ahead to 2026, most experts are discussing the latest threats that will shape the year ahead. This year, we’re seeing a new, but not unexpected, shift to autonomous threats driven by state-sponsored actors and AI. With that in mind, a new generation of threats, broadly known as...Continue reading→
What CISA’s Emergency Directive 26-01 Means for Everyone
In mid-October 2025, the CISA issued one of its most urgent orders yet: Emergency Directive 26-01. The directive calls on all Federal Civilian Executive Branch (FCEB) agencies to immediately mitigate vulnerabilities in devices from F5 Networks following a state-sponsored breach of F5’s systems and access to portions of BIG-IP source code and vulnerability data. The event...Continue reading→
Cybersecurity and Vetting AI-Powered Tools
A recent exploit involving a new AI-focused browser shone a light on a critical problem–namely, that browser security is a constant issue, and AI is just making that threat more pronounced. Attackers discovered a way to use that browser’s memory features to implant hidden instructions inside an AI assistant. Once stored, those instructions triggered unwanted...Continue reading→
Shutdown Security And Cyber Vulnerability
When the federal government shuts down, the public sees closed monuments, unpaid workers, and halted programs. What they do not see is the silent surge of cyberattacks targeting agencies already operating on fumes. During the most recent shutdown, attacks against U.S. government systems spiked by nearly 85%. Cybersecurity failures during government disruptions rarely start with...Continue reading→
Identity and the Shift from Malware
The world of cyber threats is rapidly evolving, and while we can see these changes more generally, it’s always crucial to understand them concretely. As the 2025 CrowdStrike Global Threat Report shows us, the landscape of our industry is changing. We’re digging into this report to discuss a challenging trend: the move of hackers foregoing...Continue reading→
Maintaining Compliance Against Prompt Injection Attacks
The increasing adoption of AI by businesses introduces security risks that current cybersecurity frameworks are not prepared to address. A particularly complex emerging threat is prompt injection attacks. These attacks manipulate the integrity of large language models and other AI systems, potentially compromising security protocols and legal compliance. Organizations adopting AI must have a plan...Continue reading→
Are We Already Talking About CMMC 3.0?
The ink has barely dried on the CMMC final rule, and already the defense contracting community is buzzing with speculation about what comes next. Just when contractors thought they had a moment to catch their breath after years of regulatory limbo, whispers of CMMC 3.0 have begun circulating through the industry. But is this just...Continue reading→
Centralizing Identity-Based Risk
As the traditional network boundary dissolves and remote work becomes standard practice, identities are the major frontier for security. Whether we’re talking about human users, service accounts, or machine identities, these have emerged as both the primary access mechanism and the most targeted attack vector. It has become imperative for providers to centralize identity management...Continue reading→
Deviation and Significant Change Requests in FedRAMP: A Comprehensive Guide
FedRAMP provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. While the program’s rigorous baseline requirements ensure consistent security, the reality is that this consistency calls for a little flexibility. This is where deviation requests and significant change requests come into play. These two...Continue reading→
The Costs of Compliance and Data Breaches
Data is possibly one of the most valuable assets any organization holds. Customer information, employee records, and proprietary business intelligence present challenges because the data flowing through modern enterprises represents both significant opportunities and serious risks. Businesses face a challenging balance: investing in compliance measures to protect sensitive information while also preparing for the real...Continue reading→
Related Posts