01-chinese-espionage-article-m-trends-2024.pdf

Endpoint detection and response (EDR) platforms have become commonplace among companies seeking to expand the visibility into endpoint activity necessary to provide a baseline of security monitoring. This increase in visibility has forced attackers to evolve in order to maintain operational efficacy. While some attackers have invested in EDR bypass techniques, others have, instead, chosen to focus on areas of the corporate environment where in-depth visibility remains uncommon. While EDR agents have become a standard part of security deployments, many specialized appliances that either segment or host assets critical to the organization often lack similar levels of visibility. These systems have become a new preferred safe haven for attackers as it enables them to maintain long-term…