CrowdStrike Falcon Cloud Security CNAPP with Adversary-Informed Risk Prioritization

CrowdStrike has enhanced its Falcon Cloud Security CNAPP with new capabilities designed to provide more proactive and context-aware cloud security. These enhancements aim to address critical gaps in current CNAPP solutions, including limited infrastructure visibility, the failure to incorporate adversary behavior into risk analysis, and endless alert triage. The new features include Application Explorer, which unifies application-layer visibility with cloud infrastructure context, and adversary intelligence for cloud risks, which prioritizes risks based on known adversary TTPs. These improvements help organizations understand how applications interact with infrastructure, which risks align with observed adversary behavior from over 280 tracked groups, and trace the configuration changes that introduced exposures. This allows for more effective risk remediation and faster response times, especially in the face of increasing cloud-conscious intrusions which surged 266% year-over-year in 2025.

Attack Chain

1. Initial Access: An adversary, such as LABYRINTH CHOLLIMA or SCATTERED SPIDER, gains initial access to a cloud environment by exploiting a misconfigured storage resource with overly permissive access.
2. Discovery: The attacker leverages the compromised resource to perform reconnaissance, identifying business-critical applications (e.g., payment processing, hospital ERP) that connect to the storage.
3. Credential Access: The attacker attempts to access credentials stored within or accessible by the compromised applications, potentially targeting sensitive customer PII.
4. Lateral Movement: Using the obtained credentials, the attacker moves laterally to other cloud services and resources, such as external large language models (LLMs) used by AI-driven applications.
5. Collection: The attacker identifies AI components and maps the data they can access, discovering shadow AI activity or unapproved model usage.
6. Exfiltration: Sensitive data is exfiltrated to external AI services or other attacker-controlled infrastructure.
7. Impact: The compromised data is used for malicious purposes, leading to data breaches, financial losses, and reputational damage.

Impact

A successful attack following this chain could result in the compromise of sensitive data, including customer PII, financial records, and other confidential information. Organizations operating in sectors targeted by groups like LABYRINTH CHOLLIMA and SCATTERED SPIDER, such as financial services, are at higher risk. Failure to properly secure cloud environments and applications can lead to significant financial losses, reputational damage, and legal liabilities. The increase of cloud intrusions by state-nexus threat actors by 266% in 2025 highlights the growing threat and potential impact.

Recommendation

• Deploy the Sigma rule detecting overly permissive storage access to identify potential initial access vectors, focusing on cloud environments (logsource: cloudtrail, category: configuration).
• Implement Application Explorer to gain visibility into application dependencies and identify business-critical applications at risk from infrastructure misconfigurations (reference: Overview section).
• Utilize the CNAPP's adversary intelligence to prioritize cloud risks based on observed TTPs of threat actors like LABYRINTH CHOLLIMA and SCATTERED SPIDER, focusing on industries they actively target (reference: Adversary Intelligence for Cloud Risks section).