CrowdStrike Falcon Cloud Security Advances CNAPP with Adversary-Informed Risk Prioritization

CrowdStrike has announced advancements in its Cloud Native Application Protection Platform (CNAPP) offering within Falcon Cloud Security. The updates aim to address key gaps in current CNAPP solutions, including limited visibility into business applications, lack of integration with adversary behavior intelligence, and challenges in correlating risks with configuration changes. In 2025, cloud intrusions by state-nexus threat actors surged 266% year-over-year, highlighting the need for proactive security measures. Falcon Cloud Security introduces Application Explorer for unified application and infrastructure visibility, adversary intelligence for risk prioritization based on attacker behavior, and enhanced correlation of risks with configuration changes to streamline remediation. This helps organizations focus on risks aligned with observed adversary tactics, techniques, and procedures (TTPs), such as those used by threat actors like LABYRINTH CHOLLIMA and SCATTERED SPIDER.

Attack Chain

1. Initial Access: Adversaries exploit misconfigured cloud resources, such as storage accounts with overly permissive access, to gain initial access to the cloud environment.
2. Discovery: Using tools and techniques, attackers enumerate cloud resources, including applications, services, and data stores, to map the environment.
3. Lateral Movement: Adversaries leverage compromised credentials or vulnerabilities in interconnected services to move laterally within the cloud environment, targeting business-critical applications.
4. Credential Access: Threat actors attempt to steal or obtain credentials to escalate privileges and gain unauthorized access to sensitive data or systems.
5. Data Exfiltration: Once inside the network, adversaries identify and exfiltrate sensitive data, such as customer personally identifiable information (PII), from cloud storage or databases.
6. Impact: Depending on the attackers' objectives, the final impact could involve data breaches, financial losses, reputational damage, or disruption of business operations.
7. Defense Evasion: Adversaries use various defense evasion techniques such as obfuscation or exploiting legitimate tools to avoid detection by security controls.

Impact

Successful exploitation of cloud vulnerabilities and misconfigurations can lead to significant data breaches, financial losses, and reputational damage. The CrowdStrike 2026 Global Threat Report indicates a 266% surge in cloud intrusions by state-nexus actors, emphasizing the increasing risk. Organizations operating in sectors targeted by threat actors like LABYRINTH CHOLLIMA and SCATTERED SPIDER, particularly financial services, face a higher likelihood of being targeted. Failure to prioritize and remediate these risks can result in the compromise of business-critical applications and sensitive data.

Recommendation

• Deploy the "Detect Cloud Storage with Overly Permissive Access" Sigma rule to identify misconfigured storage resources that could be exploited for initial access.
• Enable cloud infrastructure logging and deploy the "Detect Lateral Movement via Cloud Service Exploitation" Sigma rule to detect anomalous activity indicative of lateral movement within the cloud environment.
• Integrate CrowdStrike's threat intelligence feed to correlate cloud risks with known adversary TTPs as described in the overview to prioritize remediation efforts.