Lead cybersecurity agencies for several years have been warning about adversaries employing “living off the land” techniques to compromise networks, evade detection and maintain a foothold within critical infrastructure systems.
Hackers employing the approach use legitimate network tools to perform their objectives, blending into normal system activities to avoid triggering cybersecurity defenses. The technique has most famously been used by the China-linked hacking campaign Volt Typhoon, which U.S. officials say has infiltrated the networks of multiple critical infrastructure organizations.
A 2024 joint advisory issued by the Cybersecurity and Infrastructure Security Agency, the National Security Agency and several other partner agencies detailed how to identify and mitigate the technique.
But hackers continue to employ these living-off-the-land tactics, said Ron Ringgold, field chief information security officer for public sector at SentinelOne.
In August, for instance, CISA warned the Medusa ransomware group use the techniques to gain a foothold in victim environments.
Expanding cyber techniques
Cybersecurity analysts need to rely on more than signature-based defenses, Ringgold advised.
“What we have to be able to do is provide some of those advanced behavioral-based detection engines in our air-gapped environments, as we do with a lot of our cloud-connected capabilities,” Ringgold said during Federal News Network’s Cyber Leaders Exchange 2026.
“Being able to deploy an agent that not only can detect abnormal behavior from your systems and your processes and your endpoints but also be able to leverage machine learning and artificial intelligence built into the agent on the actual endpoint, so it’s detecting those anomalous behaviors that you aren’t used to seeing within those air-gapped environments.”
Ringgold highlighted the need to defend both IT and operational technology (OT) within critical networks. He said inventorying devices within those networks is crucial to defending them.
“How can we ensure that we have an accurate inventory and we don’t have any rogue devices on the network?” he said.
“Device control is another big one. Making sure people aren’t bringing in outside media and plugging it into those air-gapped environments, so being able to control, say, access to USB sticks and what you can actually bring in and read and write to disk. Having the ability to enumerate your environment, understanding your approved asset inventory, being able to detect any type of rogue devices and kick them off your network, and then being able to do device control, so you’re not allowing someone to bring in, say, a suspicious file and plug it directly into your network.”
Threat hunting in air-gapped networks
Given the advanced tactics and techniques being used by cyber adversaries, Ringgold argued for the ability to do advanced threat hunting for air-gapped networks.
“Where we can get to securing that tactical edge and getting more insight into our air-gapped environments is being able to have all of your telemetry that you’re capturing from those air-gapped environments and being able to get it into the cloud so that you’re able to do that advanced detection,” he said.
“You’re able to do threat hunting on that information that you’ve probably never been able to threat hunt on before, you’re able to enrich it with threat intelligence . . . take it back inside, retrain your agents and also train those response actions that you want to be able to take — based on the information that you’ve been able to uncover.”
Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.