EP205 Cybersecurity Forecast 2025: Beyond the Hype and into the Reality

Security running.

Hi there. Welcome to the 5th season of the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts are back for another year. It's still me, Tim Peacock, the Senior PM for Risk Analytics in Google SecOps, and Anton Chuvakin, an at this point fully reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content, and we really hope you do, and you want it delivered piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners, all on the Google Cloud Security Community page. Anton, we are talking about predicting the future today, but it felt like we were dragged back relentlessly into the past.

Yes. Well, first is we are not predicting, we are forecasting.

Oh, excuse me.

Completely different.

Completely different.

Completely?

I don't know about that.

Yeah, me neither.

We were going backwards a lot, weren't we?

We've been going backwards a lot. And I think that behind every 2010s threat, there is probably the 1990s underlying issue that was first discovered by somebody in the '80s and by some thought leader. Who knows? Maybe they didn't have thought leaders in the '70s.

Lucky them.

And then somebody hypothesized in some sci-fi book in the '70s. I don't know. At this point, I'm just becoming—

But no, It was really interesting to me that multiple times in this episode where we were really looking ahead, but to understand where we were going, we had to understand where we had come from. And so, I don't know, at the risk of getting into some kind of quantum mechanics joke that our guest Vijay would've enjoyed, maybe let's turn things over to today's guest. I'm delighted to introduce today's guest. Joining us for the first episode of the year, Andrew Kopinski, a principal intelligence analyst, which listeners, sounds like something I needed in elementary school. with the Google Threat Intelligence Group. Andrew, thank you for joining us. We are kicking off the year by talking about the year to come. We've got this forecast that we do seemingly every year, which I guess is how annual forecasting works. What's in it this year? What's exciting? And there's a lot of AI, isn't there?

There's a lot of AI. There's a lot, a lot of AI. So there's a lot of different things we tend to talk about the way that kind of Mandiant and now Google Threat Intelligence Group kind of approaches intelligence, right, is to talk about it from the attacker perspective.

Okay.

So we have the— basically, we think about espionage attackers, we think about cybercrime attackers, hacktivist attackers. Most of what we spend time talking about in there is what we call the Big 4, which happens to be kind of a slang term that we use for most of the espionage attackers that we see most often. So attackers linked to Russia, to China, to Iran, and to North Korea. So we spend time talking about that. We spend time talking about how the kind of underground ecosystem and the cybercrime ecosystem has evolved. And then we spend a lot of time talking about AI. The forecast report is a good report. It comes out every year. It tends to be kind of bite-sized, focused breakdowns of what we think is going to happen. They tend to be short paragraph or article length, and you have this kind of forward-looking bent to most of the things. So yeah, there's quite a bit in there, and there's quite a bit about AI. For several different reasons.

So tell us about the AI piece.

Yeah, I think that actually AI is, I kind of have to almost preface about with an extra comment because I feel like we read a lot of articles about this from various sources. And it's, I'm paranoid, I work in security, so it's all fine. I don't mind paranoia. But sometimes this whole, oh, attackers would use AI, run for the hills message is kind of getting a little too much. But you are like literally live this life. So how scared are you? So, and by the way, a preface to preface, when I talk to OT security analysts, I don't sleep for 3 days. So like, you don't need AI. Like, I know it's scary, but like, tell me how scary this is.

But Andrew, just to give you context on where we've previously been on the show about AI scary, we had a guest who Anton and I both really respect tell us that AI was bad because it was going to help people make dirty bombs. And I thought, you really don't need AI for that, do you? But go on and tell us where AI is in the forecast.

This is where we come back again to, how GTIG does what we do, right? We spend a lot of time looking at doing incident response. So we get a lot of our data from that where we go in and do investigations into breaches. We spend a lot of time looking at stuff in the wild. We spend a lot of time, you know, mapping out adversary infrastructure. We work very closely. Now we are very officially tied in with TAG. And so we have a lot of good visibility there. My take on AI, and I will attempt to be as neutral about this as possible to avoid some—

Be as analytical as you can.

Yes. Analytical is good. The way we approach it is what are we actually seeing, right? AI is allowing some attackers, particularly what we call IO attackers, right? So influence operation attackers, people who are creating fake news and campaigns and all this stuff, it's allowing them to do what they were gonna do faster, right? A lot of what we're seeing is, you know, there's fake news articles, there's fake broadcasters in some cases, there's all these other different clips. They are using AI to generate as much trash as they can throw to try and convince people across 100 million different platforms in many different languages of whatever they want them to believe. We are seeing some indication that there is demand in the cybercrime underground for guardrail-less AI models.

Sure.

I think that's probably the thing that's most interesting.

But doesn't this just mean open source? Does it automatically mean open source?

Kind of, right? I mean, there are open source models out there.

Open weights, open weights. Sorry.

Oh, but you know what's interesting is that means that the safety efforts by companies are working if there's demand for ones that don't have the working safety features. That's cool.

Yeah, I mean, kind of.

It won't let you—

yes, it won't let— you know, a lot of the things won't let you make malware that will— you know, you can't talk to Gemini and tell it to break into Fort Knox yet. That one's kind of interesting because we have a lot of underground attackers who have a history of finding ways to host and provide hosting for bulletproof services, it's not that much of a leap to start acquiring kind of a very quick and dirty data center and, you know, building out whatever you can with stolen or, or kind of, you know, secondhand computational stuff, even if it's just a bunch of graphics cards that you get from, you know, a hijacked shipment somewhere. The big story, I think, right, about attacker use of AI, We have not seen anywhere any indication that malicious attackers, and we're talking some of the best funded, best resourced, best trained cyber spies and units in militaries anywhere on the planet, no real indication that they found a killer app for AI.

Yes. And they're kind of like similar to many businesses. I think that's also very Right.

And I, you know, you can go back and forth about whether, you know, whether that bodes ill or positive for kind of the general AI space. But in my mind, if the smartest bad people on the planet haven't found something cool to do with it yet, I don't see a lot more evolution coming in kind of the offensive space for AI. I could be wrong, but most of what we're seeing, I think, indicates that that's not really something that has gotten a lot of traction yet, which kind of fits for enterprise options, right?

That's both optimistic for security outcomes and depressing for some people's speculative stock investment outcomes.

But it's also curiously logical. I think it's curiously logical because I think that if you experiment with AI in a rapid loop and you have no ethical boundaries, no safety boundaries, no boundaries at all, and you rapidly iterate and essentially you find Maybe not nothing, but you find mostly efficiency use cases. You don't find mind-blowing, push the button to own somebody use cases, but you get efficiency use cases. It's kind of good. I think I chalk it for the positive for security.

Yeah, I think it's positive in security. I mean, again, the thing I always caveat is I don't have any visibility into the acquisition pipeline for the People's Republic of China. So I don't know what they're building. But so far, not a lot to indicate that there's anything particularly scary on the horizon.

Okay, so AI aside, there's something very interesting in the report to me because I love thinking about where cloud and non-cloud come together, which is how compromised identities in hybrid environments are leading to compromise. And one way you might frame this is no matter what you do, you're still going to lose because of your AD infrastructure.

This is like me misquoting our Mandiant colleagues who basically remind us pretty much every time they speak in public about that.

Now, is that a fair misquoting of our colleagues or an unfair misquoting of our colleagues?

Unfair, it's something I'm also guilty of.

Ah, okay.

So right now we are working on kind of what will become the main report that's going to release around Google Cloud Next next year called mTrends. One of the things that I am working on in particular is a paper inside that larger product that is going to focus on info stealers, right? Which is just part of the ecosystem that goes out and steals logins and credentials. Info stealers are a family of malware that's been around for a very, very long time. They are in some cases 10, 15 years old, some of these source codes that we're still seeing floating around. But they're very good at what they do. And the reason that they are becoming better and more effective at what they do is that that's how people are getting into malicious places, often cloud environments, right?

Hmm.

There are plenty of cloud hosting providers out there who have gotten popped with this in the past. The best example of this past year was Snowflake. You had this kind of, you know, maniac attacker who was going, you know, through 5, 6, 7 different families and getting, going out and buying all these credentials that have been harvested with different malware from different providers, and then just using them to log into these different customer environments. The other thing that we have seen, and this is, I think, probably the cooler and more important aspect of this question, is that one of the things that, that particularly Chinese nexus espionage groups have been doing is using zero days to go after everyone all the time, forever.

Yep. Yep.

It's amazing what you can do with absolutely unlimited budget.

It is. And quite a lot other aside, but one of the things that's kind of fascinating to me is that they spend all of this time and money training and acquiring and going through this huge, huge bureaucratic process to get these zero days to the attackers. And then once they have the zero days and they get on network where they want to be, they immediately switch over and start targeting Active Directory or, you know, So much for AI ownership.

But is this like the ultimate condensation of like hard exterior and soft, chewy center? Like, is AD truly the chewy heart of organizations?

I don't know that I would call it AD. I think I would call it identity.

Okay, sure.

If you look at all of the different implementations of cloud, which is unique and annoying in every single organization, and nobody ever really has the same idea of what's happening inside an organization ever anyway. The one thing that we know is that the easiest way to manage a bunch of different cloud applications, which us being Google employees, we have to do anyway, is by trying to make sure that the person who is using the computer to log in is the person who they say they are, right? That is becoming more and more and more and more the story of cloud compromises because so many organizations out there are not Google and don't have their own kind of native cloud environment. And so to move around inside all of these different disparate kind of cloud and hybrid environments, the only way to kind of do that is managing identity. I think what we're seeing is not really this kind of hard exterior, chewy interior. I think it's this idea of bad guys have gotten really, really good at identifying the fact that every organization on the planet relies on this one particular key, which is trying to make sure whatever it is, and whether it's, you know, I was listening to the episode where you guys had Kevin Mandia on, and he was talking about kind of the particular thing inside Microsoft that the attackers were able to find to use, move around on network, it doesn't really matter what it is. If it's username and password, if it's something, if it's a session cookie, if it's, you know, whatever this thing is that the security people use to make sure that you are who you say you are, that's what is being targeted kind of universally. I think that's mostly the big picture of 2024, probably will continue to be 2025.

That actually makes sense.

It sounds like there's a couple of interesting aspects to that, one of which is the monoculture aspect, which leaves everybody vulnerable to the same set of tactics and techniques here. If we're all using that, they can do the same playbook everywhere.

Yeah. And one of the things that's in a recent report that we just put out is that actually phishing, at least in the IRs that we've done, for initial access, meaning the first thing that actors use to get on network, phishing as initial access is way, way down, like 4% of the intrusions.

That always counts as really good news because that means that it works worse, right? And they have to Well, then again, maybe not.

Is it good news or is it that it's good news for the Gmail security team? Probably.

Yeah. Yeah.

Yeah.

Is it good news for everybody? I think it's, I think what it's indicative of is attackers have found a way to move beyond using just plain phishing and there's easier and better ways to do it. And one of those ways, really kind of the main way, seems to be stolen credentials.

And I think that kind of approach and identifying it is really starting to I mean, you are trading the 2000s threat vector for the '90s threat vector, if not the '80s, stolen creds, right? So it's almost like you're going from the old to ancient. Okay, that's me being overly cynical. Fine.

Anton, be less depressing and ask the next question.

Yeah. Okay.

Yes.

No, he's not wrong. He's not wrong though.

I didn't say he was wrong. I said he was depressing.

Okay. So, but despite all that, easy breezy flying in with stolen creds. People are, and maybe Dave Itell would hate me for this saying, stockpiling zero-day, but they're collecting zero-days, right?

Yeah.

And so this is kind of one thing that the zero-day use is growing, but I naively assumed that the zero-day cost is high and getting, quote unquote, higher maybe, right? So how do you balance the zero-day cost growth with higher use? Is it not logical economically?

There's a couple things there.

Right.

One, use, for lack of a better term, zero-day generation, right, is not uniform. A lot of what we're seeing is zero-days being found and identified by kind of mostly white hat, sometimes gray hat researchers in the wild.

Yep.

We've seen those guys get targeted by espionage campaigns trying to go out and get onto their network and trying to, you know, into their machine and be like, okay, what are you researching? I'm gonna steal your zero-day. Obviously, there's always been kind of third-party vendors, which has been a problem. You know, private security and spyware is always a problem. That's one of the sources of zero days. That's probably somewhere in there is probably where like cyber criminals get most of their zero days, which is not very many, but it is, they are impactful when they get them. The thing that really stands out to me about zero day generation, and this year I think we're aiming for We're probably see about 65 new zero days that we, you know, GTIG has seen, which means zero days that we can confirm have been used in the wild by malicious attackers, which is down pretty significantly from last year where we had like 93 or something.

Hmm. Hmm.

That's still a lot.

But it's down.

The thing, it's down, but it used to be like 4. Oh, right.

But that's, you're talking about like quite some time ago. Yeah.

Like 2018, 2017, things like that. What really kind of stands out to me is that zero-day generation, for lack of a better term, has become bureaucratized in some places. You have a lot of different stuff. You have a lot of different companies in the wild and all over. You have a lot of different independent researchers. But the thing that's really driving in particularly zero-days used by Chinese nexus attackers, which is a lot of them, there is a law in China That if your company discovers a vulnerability, you have to report it directly to the government and you're not allowed to talk about it publicly. So a lot of the zero days that get found by Chinese tech companies, which is a lot of them, get directly reported to the same sponsor of Chinese espionage.

That's really nice. If you have a country, you can say like, I order you to give me your zero days, and everybody's like, here are the zero days. I didn't know you can do that. That's so cool.

And on top of that, what is the other thing that China has done historically is the Tianfu Cup and a few other of these hacking competitions where they will get all of the smartest computer science students in a room and for 4 days sit them at the computers and say, find us zero days. And if you find the coolest one, you will get scholarships and you'll get all this different stuff. And, you know, we'll see on LinkedIn, you know, I competed in the Tianfu Cup or things like that.

Oh my God.

That's Another indicator of a potentially really good place to find people, not just who are finding zero days, but also people who are good at finding zero days.

Hmm.

So what we're seeing is, yeah, I think you're correct in saying that the cost of finding zero days has gone up. They're not kind of laying around the way they used to be in, you know, a million years ago, but people are also using a lot more products these days, and the more products that people use, the more holes there's going to be in those products. And so yeah, it might be harder to find them in like O365 and Google Chrome, but it's probably not hard to find it in some killer app that just got funding 18 months ago that you're using now in your enterprise. You know what I mean?

That makes a ton of sense.

So that's kind of where we are right now.

Okay, that depressing topic. This is like a really rough start to the year, I'm feeling.

If you walk away from today depressed rather than scared, I've done a great job.

Oh boy.

Yeah, that's right. It's not— let's not switch to OT discussion.

Okay, so we'll stay away from OT. Let's just talk about detection. What are y'all seeing on like enterprise approaches to detection that work as opposed to ones that don't work? Maybe we'll take the optimistic framing. What's good in detection today?

So this is kind of an area where I have to rely on secondhand knowledge, right? Like, I was an English major who didn't know how to code when I first got hired. I still don't really know how to code, but my job is to talk with all of the people across all of GTIG and figure out what they're doing. The companies that are doing detection well, as far as I know, have simplified things.

Hmm.

They've cut down on endpoints, they've cut down on different apps they're using. They get everybody on the same system doing the same kind of thing, and they try to make things as simple and streamlined as possible, which inherently is going to shrink your attack surface, right? That's what I tend to see with a lot of these different companies that do security well, Google being probably the foremost, right? We all have the same kind of system. We all use the same kind of keys. to get around. We all have Titan keys and, and all these different things that make sure we are who we say we are. That's the biggest thing that I've seen is that, you know, a lot of these companies that get popped sometimes haven't done audits or internal inventory for 10, 15 years. The people who built systems that are still in use have moved on or retired like 10 years ago.

Mm-hmm.

And a lot of these systems work and are still around and simply just stick around until somebody realizes like, oh my God, you haven't updated this in 7 years. Like, why? What's happening here?

You know, this resonates with something a user was telling me not too long ago about how they had detection content that worked really well in one part of the organization. It was absolute bollocks in another part of the organization. And so it made their whole DNR journey harder because they lacked that— call it consistency, maybe more than simplification, but That makes a ton of sense.

Yeah, right. And you have how many companies out there, you know, Mandiant before we got acquired was a perfect kind of example, right? We had gone through— I'm now working with people at Google who hired me soon to be 12 years ago, fresh out of college across like 4 different companies. How many different organizations out there are in that same boat where they've gone through acquisition, divestiture, merger, all of these different things? Where a lot of systems are just still doing what they used to do and nobody's kind of making any waves because nothing's broken.

So it's like cue the '80s jokes again, because it sounds like some— with some companies, it's the tech stack that was born quite some time ago before Tim.

I mean, the one thing that I always— I really would, would put a lot of crowdsourced funding behind would be like a Hulu documentary about the Y2K surge, right? Like how many guys at that point who had been retired or were close to retiring came out and did all this stuff because nobody had learned COBOL or whatever the other insane languages that have been around.

Sure, sure.

If you're trying to do detection today and you have stuff that was written before many of your security folks were out of high school, you're going to be pretty hard pressed to actually figure out how to make detection work in that environment. I think that's really one of the biggest challenges that we see.

I love that the detection advice has at first blush nothing to do with the detection. It's simplified and modernized. It's not, you should use this EDR, not that EDR.

But it's also a big part of our success. It's almost like a big part of our secret on DNR is exactly that, right? I think Tim's episode mentions this quite a bit. And of course, clients hate it because we tell them, consider redoing your infrastructure based on these principles, and then this magic happens over here. And they're like, what? Okay, this is a whole separate episode. So let's skip that.

Yeah.

Mind if I intrude with the Big 4? Okay, maybe that's appropriate. So I read those sections, I read these sections, and maybe I'm too far from juicy intel work these days, but some of the stuff just read to me like hackers hack, APTs APT. It's sort of like what I expected to find there is what I found.

Yeah, absolutely.

So am I weird or is this like—

No, no. If you're somebody who's familiar with what the Big 4 have been doing, there's not a lot that's surprising. There are a couple cool kind of juicy stories. DPRK using this like IT worker scheme is—

Oh, yeah.

Super weird and fascinating. For those who don't know, North Korean spies are just trying to get hired as remote workers at like all over. And it's really weird and it keeps happening and it's very difficult to try and figure out how to stop it. That's kept us very busy. North Korea going after crypto is very busy. The biggest story I think for me is that 2024 was, thanks to a lot of the folks who have done a lot of good research, Mike Radji, who is no longer at Google, but one of the best researchers out there about China, put out this report about orb networks and all this stuff. What we're seeing in many of the different Big 4 is, if your takeaway is that hackers hack, you're not wrong. This latest update on the Big 4, it's really kind of the continuation of the next chapter in a very, very long story. We are seeing Russia kind of adapt to some stuff. We expect to see them adapt to stuff that happens outside really of cyber. We expect them to be driven mostly by what happens in the diplomatic resolution of the war in Ukraine. China is doing a lot that's going to rest very, very heavily on a lot of the decisions being made by the incoming administration. Iran, same thing. There's a lot of different moving parts that are happening way outside cyber that are going to determine how these countries actually use cyber espionage in 2025.

Mm-hmm.

I think the biggest story that I think really needs to be highlighted for me of the Big 4 is that China, with this kind of focus on generating zero days, using those zero days against endpoint detection that has to do with security and like edge network devices, and then hiding all of that behind what we call orb networks, which are basically these very, very large kind of custom-built Tor botnets that their whole purpose is just to obfuscate traffic in the wild to prevent you from being able to detect on.

Mm-hmm.

Consistent command and control infrastructure.

People would use Tor for that? No way.

It's not Tor. It's a different, it's different stuff, but it is a relay, right? It's this kind of specific relay function.

Got it.

These different kind of growths in what we're seeing and these trends really have solidified. And so what we're seeing is the final stages of maturation, especially in Chinese nexus espionage, that really solidifies the fact that not only are they the most active, they're definitely the most dangerous attackers out there in my But there's going to be a bunch of different analysts across all the different teams who are going to be screaming at me about this after this podcast.

No, no. I think DPRK, Yorkist scheme, and increased attacks against edge devices that cannot be instrumented through EDR to me are 2 very important takeaways because I keep arguing with people on X about like, and they're like, we're going to deploy EDR. And I'm like, your router is so owned, forget it. And they're like, I don't know. Sorry. Fine. Tim, go to closing.

I hate to do this, and this has been one of the— well, I haven't recorded an episode in a long time because I was out, listeners, but now I'm back. So fun to start the season this way. This has been a ton of fun, and I hate to do it, but I have to ask our traditional closing question. So, one, do you have a tip to help people maybe improve their DNR success against Chinese nexus hackers? And 2, do you have a resource to leave our listeners with something to go follow up with?

I think definitely the forecast report that just came out. There's also a webinar that just came out last week about that, which we can You know, send along a link to that. Those are probably the best resources. I think if you're curious about how to go about doing this, my one tip is to really start kind of thinking about what your threat landscape actually is. Really start having questions and start reaching out to people, you know, all across. This is our whole thing with GTIG is we are here to try and help you understand what the biggest risks are and how to combat them. You're not really going to be able to fight those risks if you don't know who's most likely to come after you.

Yeah.

I think that's probably the best, again, from somebody who doesn't do detection or engineering, that is the thing that I tend to see happen quite often. So yeah, and, you know, feel free to reach out to GTIG at any opportunity where there's folks all over the organization who are willing to help. So yeah, thank you very much for having me on. This is delightful.

Well, Andrew, thank you for joining us. Listeners, GTIG is the Google Threat Intelligence Group, and we are delighted to have Andrew from it.

Thank you very much.

And now we are at time. Thank you very much for listening, and of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at @antonchuvakin and @brent Anton underscore Chuvakin and underscore Tim Pico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Security.