Your Own IT Tools Are Being Used to Attack You

A new Huntress report finds attackers are abusing legitimate IT tools and Microsoft 365, bypassing traditional defenses to compromise businesses undetected.

A new threat intelligence report from cybersecurity firm Huntress confirms a troubling trend: attackers are increasingly using legitimate, everyday IT tools to compromise businesses. This strategy, known as “living off the land” (LotL), involves abusing software that is already installed and trusted within an organization's network. Instead of deploying obvious malware that might be flagged by antivirus software, adversaries use built-in system utilities, administrative scripts, and remote management tools to carry out their attacks. By blending in with normal IT operations, they can remain undetected for extended periods, quietly moving through networks, escalating privileges, and exfiltrating sensitive data. The report highlights that this is no longer an emerging technique but a primary method used to bypass traditional, signature-based security defenses that are designed to look for known bad files, not malicious behavior from trusted applications.

The mechanics of these attacks rely on subverting the purpose of common tools. For example, an attacker might gain initial access through a phishing email and then use PowerShell, a standard Windows scripting tool, to download further instructions or search for valuable data. They might also exploit remote monitoring and management (RMM) software, which IT teams use to maintain systems, to gain persistent access and control over compromised machines. Because these tools are legitimate and often have high levels of privilege, their activity does not trigger alarms. The challenge for defenders is distinguishing between a system administrator performing routine maintenance and an attacker using the exact same tool for malicious purposes. This shifts the security focus from identifying malicious objects to analyzing context and behavior, a significantly more complex and resource-intensive task.

This rise in living-off-the-land attacks is a direct consequence of broader shifts in the technology landscape, particularly the widespread adoption of cloud services and the normalization of remote work. With employees and systems distributed outside a traditional office perimeter, the number of legitimate remote access tools and cloud-based platforms like Microsoft 365 has exploded. Each of these represents a potential avenue for attackers to exploit. The attack surface is no longer just the company's firewall but includes every employee's identity and the configuration of every cloud service. This trend has forced the security industry to evolve, moving away from a purely preventative model toward one that prioritizes detection and response. Tools like Endpoint Detection and Response (EDR) are designed specifically to monitor for the suspicious behaviors indicative of a LotL attack, rather than just scanning for malware.

The abuse of Microsoft 365 is a critical component of this modern threat landscape. Attackers are not just targeting desktops but are also focusing on compromising cloud accounts and sessions. Once they steal a user's credentials or session token, they can operate entirely within the cloud environment without ever placing malware on a device. They can access and exfiltrate data from SharePoint, send phishing emails from the compromised account, or create malicious inbox rules to hide their tracks. This type of attack is invisible to traditional endpoint security and requires a deep understanding of cloud security configurations, identity management, and application permissions. It underscores the importance of securing identities with multi-factor authentication (MFA) and carefully monitoring cloud environments for anomalous activity, such as logins from unusual locations or unexpected changes to account permissions.

For businesses, the key takeaway from the Huntress report is that the defensive playbook must adapt. Relying on antivirus and firewalls alone provides a false sense of security against these sophisticated attacks. Organizations need to prioritize visibility into their own systems and applications. This means implementing robust logging and monitoring across endpoints and cloud services to establish a baseline of normal activity. From there, teams can use behavioral analytics to spot deviations that could signal an attack. Enforcing the principle of least privilege—ensuring users and applications only have the access they absolutely need—can also limit an attacker's ability to move laterally. Looking ahead, security teams must invest in both the tools and the human expertise required for proactive threat hunting, actively searching for signs of compromise rather than waiting for an alert.

This trend invalidates security strategies that rely solely on blocking known malicious software. For engineering and security teams, it means the attack surface now includes trusted IT and admin tools, requiring a fundamental shift toward monitoring for anomalous behavior rather than just malware signatures.

Companies face a higher risk of prolonged, undetected breaches as attackers blend in with normal IT activity. This can lead to significant financial and reputational damage and suggests that current security investments may be misaligned with how modern attacks actually work.