Black Hat USA 2025 | Martin Zugec, Bitdefender

Clips
More from Black Hat USA 2025

Martin Zugec

Technical Solutions Director

Bitdefender

play_circle_outline Meet Martin Zugec: Leading Bitdefender's Innovative Approach to Endpoint Security and Advanced Research Solutions

play_circle_outline Exploring Living Off the Land: Ransomware Affiliates' Growing Use of This Attack Technique in Recent Years

play_circle_outline Importance of proactive security measures over reactive incident response.

play_circle_outline Introduction of Bitdefender GravityZone PHASR for proactive hardening solutions.

Info
Transcript

Martin Zugec, Bitdefender

Martin Zugec

Technical Solutions Director Bitdefender

At Black Hat USA 2025, Martin Zugec, technical solutions director at Bitdefender, joins theCUBE’s Jackie McGuire to unpack the rapid rise of “Living Off the Land” (LotL) attacks and the urgent need for proactive hardening in modern security strategies. Zugec explains how attackers are increasingly abandoning malware in favor of exploiting legitimate administrative tools already present in target environments, making traditional detection and blocking approaches ineffective. Drawing from Bitdefender’s research of over 700,000 multi-step security incidents, he ... Read more

explore Keep Exploring

What is Bitdefender and what is the role of the speaker within the company? add

What is the Living Off the Land attack and how has its usage among threat actors changed in recent years? add

What measures are commonly taken to protect against Living Off the Land attacks in high-budget environments? add

What is Bitdefender GravityZone PHASR and how does it differ from traditional security measures in detecting and preventing attacks? add

bolt Powered by CUBE AI

Martin Zugec, Bitdefender

search

Jackie McGuire

>> Hello CUBE community. Welcome back to Black Hat 2025 at Mandalay Bay in Las Vegas, Nevada. I'm Jackie McGuire, your practice lead and principal analyst for security and favorite security host at theCUBE. And I am here with Martin Zugec. He is the, let me make sure I get your title correct. He is the technical solutions director at Bitdefender. Welcome Martin. Thank you so much for joining us.

Martin Zugec

>> Thanks for having me.

Jackie McGuire

>> Awesome. So we've spoken a handful of times before. I'm very familiar with Bitdefender. But for any of our viewers who haven't heard of Bitdefender before, can you tell us a little bit about what you do and what your role at Bitdefender entails?

Martin Zugec

>> So first about Bitdefender, we are an endpoint security company. We do consumer, we do technology licensing, but in my case, I'm part of the business unit, business division. We have been on the market for long time and one thing that makes us special and significant, we have been always heavily, heavily focused on research. So we have hundreds of security scientists that are working with us. We have close ties to academia. We publish a lot of research.

Jackie McGuire

>> Yeah.

Martin Zugec

>> And what I am doing, the way how I like to describe my job, I'm the popular scientist of the company. So I'm sitting between all these hundreds of researchers and scientists that we have in public so I'm trying to translate the security research that we have into industry education.

Jackie McGuire

>> I'm also a nerd translator. I feel like that's what I do for a living. All right, so we actually did a webinar together. I did a webinar with Bitdefender a month or two ago, and one of the focuses was Living Off the Land. So if you could, just give a TLDR of what Living Off the Land is. And then you've got some pretty interesting statistics about types of attacks that use this.

Martin Zugec

>> Oh, exactly. So Living Off the Land attack is something that existed for decades, essentially. And it is the technique where the threat actors come on a compromised endpoint network, whatever it is, and instead of bringing their own tool, they just look around and use whatever is already available to them. But what we have been observing over the last, I don't know, let's say three years, two, maybe three years, is that more and more threat actors, ransomware affiliates are pretty much completely switching to only using Living Off the Land attack, which means there is no malware involved at all and all these attacks are happening without introduction of any code or anything that can be detected or blocked on these endpoints.

Jackie McGuire

>> Yeah. And what types of attacks utilize this? Is this data exfiltration? What types of things are you seeing?

Martin Zugec

>> All. Every single one. So I am doing a lot of, I am helping to publish a lot of research that we do. We are looking at ransomware affiliates. We are looking at professional groups that are targeting large corporations. We are looking at instances called lone wolves where it's a single person that attacks the whole network. We are looking at APTs and really all of them are using this technique. And again, something that is happening with cyber criminals all the time, they keep experimenting. If one of them figures out something that works, you can see it's spreading across this whole ecosystem really quickly. So again, it's all stages of attack, it's all kinds of attacks. We are seeing it all over the place.

Jackie McGuire

>> I always say you have to really respect the ingenuity and entrepreneurship of attackers. And I always say if we could only find ways to give those people good things to do before they do the bad things, it would be great because they're very creative. And as soon as you find a way to defend against one thing, they're like, well, guess what? We found a way to use that against you. So what are some of the most common techniques of Living Off the Land that you see? Are there really common resources that you see attackers exploiting or common paths that customers could be easily addressing that they're not?

Martin Zugec

>> So I will make this more specific for conversation and let's focus, for example, on ransomware. I can talk about APTs that we are taking. Those are more specific, but ransomware affects everyone today. So with ransomware, essentially what we are seeing is that every attack can be divided into two segments. First one is initial access that is social engineering or more and more exploiting vulnerabilities. There is new vulnerability. You have less than 24 hours to patch it now or they get inside. Then once they get inside, very often it can take weeks or maybe months when nothing happens because what we are seeing is that they are attacking so many companies in such a short time that they need to go over them and it takes some time.

Jackie McGuire

>> So 12 times have almost doubled in the last 5 years, right?

Martin Zugec

>> Oh, absolutely. It is longer than it used to be. So I have anecdotes we've been watching. One investigation that we've done, for example, that was new vulnerability, less than 24 hours, one of the companies was compromised. Again, this window is shortening a lot. And then it took the threat actors about a month before they came back. During that single month, there were 70 more threat actors that compromised the same server. And that is not exceptional. That happens all the time.

Jackie McGuire

>> Yeah. And I would imagine with AI and the ability to automate some of these things, if you know there's a vulnerability as an attacker, you can just start crawling for it. So it used to be you had to find your targets and try to exploit that vulnerability, but now you don't really have to do the first part of the kill chain. The discovery is automated for you. So what do you think is the biggest challenge with stopping the Living Off the Land techniques? We're going to solve all of the problems of Living Off the Land right now. So just tell me, we're going to start with challenge and then you're going to tell me how to solve all of the problems.

Martin Zugec

>> So we approached this problem academically. Again, something that we like to do, and what we did is, that we investigated 700,000 security incidents because we wanted to see first of all, how common are these attacks? We went through 700,000 security incidents, not alerts, but multi-step attacks. We found out that about 84% of them are using Living Off the Land attack. So that is the first thing we did. Then we validated the same data with our SOC. They came up with the number 85%. So we are seeing these attacks all over the place. And what we wanted to do, is we wanted to compare this with the data where we see how administrators are using the same tools. And the objective was very simple, hey, here is the list of 20 tools that attackers love to use. No one else is using them. You can just block them. And guess what, we did not make that list because what we found out is that the more popular the tool was with attacker, the more popular it was also with normal administrators. So at the end, if you want to block these tools that are now used by companies, you still have to leave the tools that are the most useful for attackers. So that is what makes it really, really hard. First of all, there is no malware, so you cannot detect that something is coming from the network on your machines because there is nothing. And second, you just cannot block these tools because your business would not operate without them.

Jackie McGuire

>> Yeah, and it's crazy, you don't actually have to hack in. You can just go buy a login credential a lot of the time. And then I try to think about as a small or mid-market, mid-size business, who's looking at all of this and like, okay, what do I do about that though? If the tools that are most critical to us protecting ourselves, helping our business function are also the tools that are, because they're very powerful, the favorites of the attackers, so how do I do proactive hardening if I'm a smaller business if I don't have the resources, if I'm not a giant bank with billions of dollars in budget?

Martin Zugec

>> That is a big challenge. And I would say today, the most common protection for Living Off the Land attack, and again, essentially the most common protection, again, most of these attacks is early detection and response. So you are reacting. You have someone, you have SOC or you have NDR that is monitoring your environment and looking for anomalies and just responding.

Jackie McGuire

>> Putting fires out.

Martin Zugec

>> Yeah, exactly. So it's very reactive. Based on this research that we've done, we actually came up with our new solution called Bitdefender GravityZone PHASR.

Jackie McGuire

>> It's a proactive, hardening and attack surface reduction?

Martin Zugec

>> Yes, exactly. And of course, we came up with the name and then realized the economic-

Jackie McGuire

>> It was phasing, yeah.

Martin Zugec

>> Yeah, the economy is very good.

Jackie McGuire

>> I mean that's a nerd's delight, right?

Martin Zugec

>> Yeah. And it's really, at this moment, it is based on this research that we've done into Living Off the Land attacks and there is no similar tool on the market, but I expect over the time, we as industry, will have to adapt and we will need to start implementing more preventative controls and proactive security instead of just responding.

Jackie McGuire

>> So how does PHASR approach detecting this behavior differently than just waiting until something goes wrong and putting the fire out? What's different about how the tool approaches these techniques and detecting that activity before it's an issue?

Martin Zugec

>> So PHASR is doing few, it's a combination of few things that are done differently by PHASR. The first one is, and I could spend one hour going into all the insights from the research. One of the insights that we have is that in many cases, it is not specific tool. It is specific use or functionality of that tool.

Jackie McGuire

>> Got it. So the ability to move large amounts of data or the ability to access a specific open port?

Martin Zugec

>> Exactly. So what we are doing with PHASR is that in some cases we are looking at the applications themselves or the tools themselves, but in many cases, we are only looking at the partial functionality of that tool that we know administrators never use, but attackers are using it. That's number one. So this is all based on our very deep understanding of what the threat actors are doing, what are the playbooks, how they operate, which tools are they using at different stages of the kill chain. So that is one. The second thing is that PHASR is building these profiles for every single combination of user and machine. So for example, domain administrator, that is doing something on laptop, the expectation of PHASR, how he or she should behave, will be very different than domain administrator doing something on domain controller for example. So it's very easy. We can look at the big parts of the company and we can say, hey, 95% of HR will never use PowerShell. It is one button where you can just disable it. So it's this combination of us defining rules based on the research into threat actors, and at the same time, not applying those rules to everyone, applying them to individual users based on their behavior.

Jackie McGuire

>> And what's the impact on teams when they're able to do that? Is it a gain in efficiency? Is it saving money? If teams are able to understand these things and proactively start to address those issues, what's the most common benefit you hear from customers, beyond I'm not losing sleep at night?

Martin Zugec

>> So one of the biggest benefits is essentially you are not disrupting your business. You don't have end users calling you, "Hey, this stopped working. This is not working." So I know it's not like security benefit, but it is, can we actually use this technology in real life? If we are talking about the SOCs, if we are talking about security analysts, what it means for them is that when they will see any alerts from PHASR, again, this is based on the playbook of threat actors, they are going to see, this is highly unusual for this user. And if you think about it, if you are attacker, you are trying to keep low profile. I can use this tool for discovery for data exfiltration. That tool doesn't work. What are you going to do? You're going to panic. You're going to think, I need to disable endpoint security. Very noisy. I need to download something else. Very noisy. I need to move to another machine where I will try to do the same thing. Very noisy. So you are really pushing them into, you cannot be quiet anymore. You need to decide between all these bad options that are in front of you.

Jackie McGuire

>> Yeah. And so if you disable the ability of attackers, they just move on, right? It's one of the things I learned living in the Bay area is I bought a convertible and I lived in a not great neighborhood and when I would lock the car, they would cut the top.

Martin Zugec

>> Oh wow.

Jackie McGuire

>> It was like if you just leave the car unlocked with nothing in it, they open the door, they see nothing's in it and they move along. So attackers are not, they're lazy and they're looking for the quick easy.

Martin Zugec

>> Oh yeah, absolutely.

Jackie McGuire

>> And so I think what you mentioned is they generally compromise multiple customers at once and then go through them one by one. So I guess if you can make it so that they hit a brick wall as soon as they get in, they're going to be like, well, I have 10 other people on the list and I could just pivot to somebody who's-

Martin Zugec

>> Well, from perspective of attackers, think about it this way. The reason why they are using these playbooks is that in almost all these attacks, I compromise 500 companies in one day, then I will go one after another. I'm always going to follow the same playbook. I always know these tools are going to be available to me because they are part of the operating system. I know exactly how I can use them. So again, it can be playbook that I just follow in every single one of these victims. If every victim is going to be different and every system of every victim is also going to be different, suddenly I need to have completely different set of skills because I cannot just follow.

Jackie McGuire

>> You actually have to be able to hack.

Martin Zugec

>> Yeah you have to. You cannot just follow. Many of these ransomware groups they literally have the manuals that are saying, hey, you do this in this order and you are done.

Jackie McGuire

>> Yeah.

Martin Zugec

>> Simple as that. And it's no longer possible because suddenly, we'll need to think, I cannot do this. I cannot use this tool. I need to behave differently. And again, all of this is going to generate some noise. So if you have any security operations, you will start seeing high severity alert. You are going to notice, yeah, something bad is happening on my network.

Jackie McGuire

>> All right. I know we probably have a lot of viewers who want to find out more, and we were talking before this and I know you've curated a pretty awesome set of content where people can find out more about how you think about proactive hardening, things they can do, tutorials. So people can find that at your website?

Martin Zugec

>> Yeah, so we will include-

Jackie McGuire

>> Well, we'll make sure there's a link in the description, yeah, but tell us more about that.

Martin Zugec

>> Essentially what it is, is that I speak a lot at conferences with reporters and such. I have the list of the content that is all related to this problem. So it's combination of explainer, these are the categories, these are the most common tools. It's the research that I was telling about, like hey, we look at all these hundreds of thousands of security incidents, this is what I learned. And then it slowly goes down talking about different solutions. So it's combination of different content and all of them you can find in one place.

Jackie McGuire

>> That's amazing. The tribal knowledge that we're able to share in security is what makes us a community.

Martin Zugec

>> Yeah, exactly.

Jackie McGuire

>> Martin, thank you so much for joining us. This was amazing. I hope everybody comes and finds you, goes and checks out your content, and we'll have you back again soon because we could probably talk for a couple hours about that.

Martin Zugec

>> Absolutely.

Jackie McGuire

>> Thank you.

Martin Zugec

>> Thank you very much.

Jackie McGuire

>> Yeah. Stay tuned. We'll be back shortly with more coverage from Black Hat 2025 at Mandalay Bay in Las Vegas. I'm Jackie McGuire and we have great guests coming up, so come right back.