Living-off-the-land (LOTL) attacks

Living-off-the-land (LOTL) attacks are a class of cyberattacks in which threat actors use legitimate, built-in tools and trusted system utilities to infiltrate, persist, and move laterally within a network, rather than deploying traditional malware. By leveraging native operating system features and trusted administrative tools, attackers can evade detection, blend in with normal activity, and reduce their forensic footprint.

LOTL techniques are a cornerstone of modern cyberattacks, particularly in advanced persistent threats (APTs), ransomware campaigns, and fileless malware operations.

Why LOTL attacks matter

LOTL attacks matter because they weaponize trust itself by turning the tools, identities, and systems that organizations rely on into attack vectors.

According to the ConnectWise 2026 MSP Threat Report, modern attackers are no longer relying primarily on exploits or custom malware. Instead, they are abusing trusted identities, legitimate system tools, and existing access paths for a faster and more reliable entry into environments.

This shift has major implications for cybersecurity teams and managed service providers (MSPs).

1. Trust is now the primary attack surface

Attackers increasingly exploit:

• Valid user credentials
• Misconfigured VPNs and remote access tools
• Trusted software and automation workflows

Rather than triggering alarms, these actions often appear legitimate because they use native system tools and valid credentials.

2. Traditional defenses are no longer sufficient

Signature-based antivirus, perimeter firewalls, and basic email security struggle to detect LOTL activity because:

• They often operate without introducing traditional malicious files
• Activity occurs within approved applications
• Execution often happens in memory or via user-initiated actions

The report highlights that reactive security models fail to detect attacks early, allowing adversaries to progress deep into the attack lifecycle before being noticed.

3. Speed and scale of attacks have increased

Modern threat actors prioritize access, reliability, and speed over sophistication:

• Rapid “scan, steal, encrypt, and exfiltrate” ransomware workflows
• Domain-wide compromise within hours of successful authentication
• Automated credential abuse and lateral movement

Because LOTL techniques rely on existing tools, attackers can move quickly without needing to develop or deploy additional payloads.

4. Identity and behavior are the new battleground

The report emphasizes that identity, privilege, and execution context are now central to both attack success and defense.

This aligns directly with LOTL tactics, which:

• Depend on credential compromise and privilege escalation
• May blend into normal administrative behavior
• Exploit gaps in visibility across identity, endpoint, and network layers

5. LOTL is foundational to modern ransomware and APTs

Most successful attacks now combine:

• Credential abuse
• Native tool execution
• Lateral movement via legitimate protocols

The result: By the time ransomware is deployed or data is exfiltrated, attackers may have already operated undetected for extended periods.

How living-off-the-land attacks work

LOTL attacks typically follow a multi-stage lifecycle, relying on legitimate tools at each phase.

1. Initial access

Attackers gain entry through common vectors such as:

• Phishing or spear phishing
• Exploiting vulnerabilities
• Credential theft or brute force attacks

2. Execution using native tools

Instead of dropping malware, attackers execute commands using built-in utilities such as:

• PowerShell
• Windows Management Instrumentation (WMI)
• Bash or SSH (Linux/macOS)

3. Persistence

Attackers maintain access using legitimate mechanisms:

• Scheduled tasks
• Registry modifications
• Startup scripts or services

4. Privilege escalation and lateral movement

Using administrative tools and stolen credentials, attackers move across the environment:

• PsExec
• Remote Desktop Protocol (RDP)
• Windows Admin Shares (C$, ADMIN$)

5. Data exfiltration and impact

Sensitive data is exfiltrated using trusted tools or encrypted channels, often culminating in:

• Data theft
• Ransomware deployment
• System disruption

Common LOTL tools and techniques (LOLBins)

LOTL attacks rely heavily on living-off-the-land binaries (LOLBins), which are legitimate executables that can be abused for malicious purposes.

Windows LOLBins

• PowerShell: Script execution, downloading payloads, lateral movement
• WMI (wmic.exe): Remote execution and reconnaissance
• exe: Downloading and encoding/decoding files
• exe: Executing remote scripts
• exe: Running malicious code via DLLs
• exe: File transfer and persistence

Linux/macOS equivalents

• Bash/sh: Command execution
• Cron jobs: Persistence
• SSH: Lateral movement

Netcat: Data exfiltration and backdoors