21/7 attacks refer to persistent, round-the-clock cyber intrusions that target cloud platforms, APIs, and identity systems. These campaigns rely on automation and stealth to maintain access across production, staging, and backup environments.
Organizations face material exposure when dormant accounts, misconfigured services, or stale tokens remain active for months or years. The following sections outline detection patterns, exposure surfaces, and response guidance for 21/7 operations.
| Vector | Typical TTPs | Impact Level | Recommended Controls |
|---|---|---|---|
| Credential Phishing | Spear messages, brand mimicry, MFA fatigue | High | Conditional access, phishing-resistant MFA |
| Cloud Misconfigurations | Overly permissive roles, public storage, weak policies | Critical | Policy-as-code, continuous posture management |
| API Abuse | Broken object-level authorization, excessive scopes | High | Rate limiting, strict scope segregation |
| Token Theft & Replay | Session hijacking, SAML relay, OAuth compromise | Critical | Short-lived tokens, binding context, revocation |
Threat Hunting for 21/7 Persistence
Threat hunting for 21/7 behavior requires combing through identity logs, API gateways, and cloud audit trails. Analysts look for intervals of activity that never drop to zero, lateral moves across subscriptions, and abnormal elevation patterns.
Data Sources and Time Windows
Effective hunting combines CloudTrail, Azure AD sign-in logs, and SaaS audit trails. Queries often span 45 to 90 days to uncover dormant access that reactivates on a schedule.
Key Hunting Queries
Use anomaly baselines, such as logins at odd hours from new geolocations, token usage beyond typical business windows, and repeated failed attempts followed by success. These indicators help surface stealthy 21/7 footholds.
Identity Attack Surface Reduction
The identity attack surface includes users, service principals, machine identities, and legacy protocols that rarely rotate. Attackers abuse weak federation settings and orphaned entitlements to sustain 21/7 presence without raising alarms.
Reduce Standing Access
Apply least privilege, time-bound roles, and break-glass workflows. Remove unused licenses, enforce just-in-time elevation, and prune groups that have not been accessed in multiple quarters.
Secure Federation and Protocols
Prefer modern standards, rotate signing certificates, and disable legacy protocols where possible. Tighten trust relationships between IdPs, SPs, and API consumers to limit lateral reach.
Cloud Workload Protection for 21/7 Threats
Cloud workloads that run under high-privilege identities become long-term targets for 21/7 campaigns. Compromised containers, functions, or VM extensions can provide stable footholds if secrets are mishandled.
Secrets and Key Hygiene
Rotate keys, avoid hardcoded credentials, and use managed identity features. Centralize secrets in vaults with strict access policies and automatic expiration.
Runtime Monitoring and Integrity
Instrument workloads with integrity monitoring, egress filtering, and anomaly detection. Alert on unexpected child processes, unusual network patterns, and configuration deviations from baseline.
Hardening Roadmap for 21/7 Resilience
- Classify identities and remove unused, high-privilege accounts.
- Enforce least privilege and time-bound access across cloud and SaaS.
- Enable phishing-resistant MFA and adaptive conditional access.
- Deploy policy-as-code for continuous configuration validation.
- Instrument centralized logging with 45–90 day retention for hunting.
- Automate secret rotation and key lifecycle management.
- Run breach and attack simulation to validate detection rules.
FAQ
Reader questions
How can I detect low-and-slow 21/7 activity in my logs?
Look for periodic logins outside business hours, consistent API calls from the same tokens, and tiny bursts that stay below alert thresholds. Correlate identity events with resource access to expose persistent channels.
What are the most common misconfigurations that enable 21/7 access?
Overly broad role assignments, public storage buckets, disabled security controls, and stale service principals allow attackers to remain unseen. Regular audits and policy-as-code guardrails reduce these openings.
Can 21/7 attacks bypass time-based MFA requirements?
They can when attackers capture fresh sessions, abuse MFA fatigue, or compromise federation endpoints. Combine phishing-resistant factors, device health checks, and risk-based policies to maintain tight control.
What response steps are most effective after discovering 21/7 persistence?
Is the workload, revoke tokens and keys, rotate credentials, reevaluate identities, and patch the initial foothold. Preserve logs for forensics and update detection rules to catch similar patterns early.