State-sponsored actors weaponize enterprise SaaS tools to execute stealthy living off the land attacks

State-sponsored adversaries are increasingly bypassing traditional perimeter defenses by weaponizing legitimate software and infrastructure to execute living off the land attacks. This strategic shift marks a transition from immediate data extortion toward long-term espionage and persistent pre-positioning within the enterprise stack.

According to a new threat report from Cloudflare, adversaries are actively targeting high-trust Software-as-a-Service and Infrastructure-as-a-Service platforms to camouflage malicious activity. Threat actors now leverage common enterprise tools such as Google Calendar, Dropbox, and GitHub to blend their communications into normal operational traffic.

Tony Fergusson, CISO in residence at Zscaler, noted that these tactics are a direct response to improved enterprise security postures. As organizations enhance their ability to detect known threats and patch vulnerabilities, attackers must adopt stealthier methods to maintain access.

Organizations have made significant progress in their ability to detect threats and patch systems more effectively. Consequently, adversaries are being forced to be more stealthy to exploit data, and they’re doing this by leveraging legitimate tools and processes.

Razvan Ionescu, head of offensive security services at Pentest-Tools.com, observed that while enterprises invest heavily in signature-based detection, monitoring of administrative tools remains insufficient. This visibility gap allows attackers to use existing endpoint management platforms and cloud consoles to stay under the radar.

The Cloudflare report identifies four primary nation-state adversaries—Russia, China, North Korea, and Iran—each utilizing these tactics to meet specific operational goals. For example, the Chinese group FrumpyToad has been observed using Google Calendar for command-and-control communications to establish nearly invisible architectures.

Dana Simberkoff, chief risk privacy and information security officer at AvePoint, explained that living off the land tactics are particularly attractive to actors seeking strategic intelligence. These campaigns aim for long-term access rather than immediate financial gain, allowing for disruption to be triggered during future geopolitical events.

Tracey Hannan-Jones, consulting director for information security at UBDS Digital, warned that supply chain compromises are frequently used as leverage to reach downstream targets. By pre-positioning within critical systems, state actors can collect strategic intelligence across diplomatic, military, and technological sectors.

The complexity of modern digital environments, characterized by numerous identities and third-party integrations, provides ample opportunity for attackers to hide. Organizations with cloud-first strategies and those in regulated industries are particularly exposed to these high-trust exploitation methods.

Artificial intelligence is further refining these techniques by automating the reconnaissance phase of an attack. Adversaries use AI to analyze public data, such as organizational charts and technical documentation, to infer likely technology stacks and access paths with high precision.

This automated intelligence reduces the need for noisy trial-and-error methods that typically alert security teams. Malicious activity increasingly resembles standard administrative behavior, making it difficult for traditional security operations centers to distinguish between a legitimate update and a breach.

Technical leaders must transition from a prevention-only mindset toward detecting misuse and limiting the potential impact of a compromise. Simberkoff recommends implementing rigorous identity governance and maintaining detailed logging of all administrative activity to surface anomalies.

Ionescu advises organizations to explicitly map their blast radius by evaluating the potential damage an attacker could cause with compromised administrative credentials. This assessment should specifically cover identity providers, endpoint management platforms, and cloud management consoles.

Effective detection logic must move beyond signature matching of known bad payloads toward anomaly detection on administrative actions. Monitoring should focus on maintaining operational security and identifying patterns that deviate from established baseline traffic.

Future security strategies will require operational playbooks designed specifically for quiet compromise scenarios. Rather than focusing solely on ransomware response, infrastructure teams should define what suspicious administrative activity looks like in their specific environment.

Enterprise leaders should prioritize the development of response runbooks for identity compromise and token theft. Monitoring the evolution of SaaS-based command-and-control methods will be essential as adversaries continue to exploit the trust inherent in the modern enterprise stack.