2023 Adversary Infrastructure Report

Insikt Group’s 2024 adversary infrastructure outlook anticipates more government-led takedowns but continued resilience of criminal operations, with APTs and cybercriminals increasingly leveraging commodity C2 frameworks, RMM tools (e.g., AnyDesk, ConnectWise), and legitimate platforms (Telegram, GitHub) to evade attribution. The report foresees incremental AI-driven gains in naming, planning, and obfuscation, and highlights commonly observed tools including Cobalt Strike, Viper, Meterpreter, and RATs such as AsyncRAT, QuasarRAT, PlugX, ShadowPad, and DarkComet. It advises organizations to baseline legitimate internet services and consider TLS decryption and monitoring while weighing privacy, cost, and productivity impacts.