This webinar, hosted by Calibia Technologies and featuring a GigaOm analyst, delves into the escalating cyber threat landscape of 2025, emphasizing the transformative impact of Artificial Intelligence (AI) and Large Language Models (LLMs) on offensive capabilities. The speakers highlight how LLMs enable autonomous zero-day exploitation and the generation of highly evasive, polymorphic malware, rendering traditional signature-based detection inadequate. Advanced persistent threats (APTs) like Volt Typhoon are examined for their success in evading detection by exploiting unmanaged systems, utilizing valid identities, and employing "living-off-the-land" techniques. The core solution proposed is advanced deception technology, which proactively defends by dynamically altering the attacker's environment with realistic traps (decoys, honey tokens, breadcrumbs) across endpoints, networks, identity stores (like Active Directory), and critical infrastructure (cloud and OT/ICS environments). Through practical scenarios, the presentation demonstrates how deception provides early, high-fidelity, and precise alerts against stealthy identity exploits, cloud-native attacks, and operational technology compromises, thereby filling critical detection gaps and thwarting attacker objectives before significant damage can occur.
Key Takeaways from the Webinar:
0:00 Webinar Introduction & Agenda: The webinar introduces Anand Kala (Calibia Technologies CMO), Chris Ray (GigaOm Analyst), and Suril Desai (Calibia VP, Deception Engineering), outlining discussions on evolving cyber threats, AI's role, APTs, and the application of cyber deception.
LLM agents can autonomously discover and exploit zero-day vulnerabilities in open-source software, making traditional signature-based defenses largely ineffective.
LLMs enable attackers to generate unique, functional offensive PowerShell scripts from natural language prompts, lowering the barrier for attackers and producing polymorphic variants that evade checksum- or signature-based detection.
4:27 Stealthy Active Directory & Volt Typhoon Attacks:
Research by NSA and Five Eyes (Sept 2024) identifies 17 common Active Directory attacks that are notoriously difficult to detect because malicious actions (e.g., Kerberoasting, silver ticket attacks) blend seamlessly with normal operations.
Volt Typhoon, an APT, successfully evades detection by targeting unmanaged, bespoke internet-facing systems (lacking EDR/logging) for initial access, then using valid identities and living-off-the-land techniques for lateral movement and privileged credential theft.
12:52 Traditional Security's Limitations: Traditional security, focused on known threats and MITRE ATT&CK TTPs, struggles against rapidly evolving, AI-driven, and stealthy attacks that appear legitimate. This necessitates additional defense layers beyond TTP-centric detection.
15:01 Advanced Deception Technology (ADT) as a Solution:
ADT is a foundational layer for "preemptive security," actively changing the attacker's environment with "active traps" (decoys, honey tokens, breadcrumbs) to alter their perception and cognition.
It provides early, high-fidelity alerts as any interaction with a deceptive element is inherently malicious, making detection precise.
Deceptions can be deployed across endpoints, identity stores (Active Directory), networks, and cloud environments.
Example (Volt Typhoon defense): Placing deceptive public-facing gateways, honey tokens representing privileged AD accounts, and decoys for high-value assets can trigger immediate alerts upon attacker interaction.
18:41 Deception Fills Skill & Detection Gaps: Chris Ray emphasizes that AI/LLMs accelerate attacker tactics, widening the gap between attacker capabilities and traditional detection methods. Deception directly addresses this gap by focusing on stable attacker objectives (e.g., data access, privilege escalation) rather than constantly changing techniques.
26:48 Use Case: Defending Against Identity Threats (AS-REP Roasting):
Attackers use LLM-assisted reconnaissance and tools like Rubeus to perform stealthy AS-REP roasting attacks to gain credentials.
Deception counteracts this by placing a deceptive Active Directory account configured to appear vulnerable; any attempt to exploit it triggers an immediate alert for the defender.
29:35 Use Case: Defending Against Cloud-Native Attacks:
Attackers perform "living off the cloud" attacks using built-in cloud APIs (not malware) to enumerate and assume administrative roles (e.g., AWS IAM roles).
Deception places "token roles" that deny assumption attempts but immediately alert defenders to the malicious activity.
Operational Technology (OT) environments are highly vulnerable due to outdated and unmanaged systems.
Deception is particularly effective here, mimicking specific industrial controllers (e.g., Rockwell, Siemens PLCs) and their firmware. Interaction with a deceptive PLC (e.g., attempting a "stop CPU" command) provides an early warning before real OT operations are impacted.
Undetectability: Customizing deceptive elements (e.g., organization-specific URLs for tokens) makes them more legitimate. Multi-layer deception across the OSI model increases opportunities for observation without immediate detection.
Upkeep: Automated deception platforms handle management and adapt to asset landscape changes (new/removed assets) without extensive manual configuration. Deception's focus on stable attacker objectives makes it resilient to evolving threats.
Starting Deployment: Manual deployment is generally inefficient and risky. It's recommended to start with a narrow scope, define clear objectives, and consider beginning deployment at network entry points (DMZ) or around high-value assets, then expand iteratively.