How can organisations defend against CostaRicto?

How CostaRicto defence works in practice

Defence is strongest when you treat costaricto as an internet-facing intrusion pattern that combines exposure on edge systems, follow-on command execution, and quiet persistence. The immediate priority is to reduce the number of reachable administration paths, harden the systems exposed to the internet, and make abnormal remote execution visible before it becomes a foothold for later movement.

That means focusing on the places where the initial access path is most likely to exist: perimeter appliances, remote access services, and any host that can be managed from outside the core network. When those systems are overexposed or weakly segmented, an attacker can turn a single reachable service into broader access, especially if administrative tooling, stored credentials, or trusted network routes are reachable from the same host.

Where CostaRicto leaves defenders exposed

CostaRicto-style activity becomes dangerous when organisations assume that a perimeter system is only a gateway and not a target. Exposed hosts often have privileged network visibility, access to internal services, or the ability to launch administrative commands, which makes them attractive for persistence and staging.

Visibility gaps matter as much as the initial exploit path. If logs from remote access systems, shell invocation, authentication events, and outbound traffic are not centrally reviewed, the attacker can blend into normal administration patterns and remain on the asset long enough to enumerate the environment or pivot inward.

Strong baseline hardening and segmentation are still the most important structural defences, and a NIST Cybersecurity Framework 2.0 approach helps align those controls across identify, protect, detect, respond, and recover activities. For exposed systems, pair that with NIST SP 800-207 Zero Trust Architecture so the network position of a host does not automatically grant broader trust.

Detection and response priorities for exposed hosts

The most useful detections are behavioural, not signature-only. Look for unusual command execution on internet-facing assets, unexpected parent-child process chains, and authentication events that do not match the system’s normal administrative pattern. Outbound connections from a perimeter host deserve special attention when they go to uncommon destinations, use unusual ports, or occur soon after suspicious logins or command activity.

Hunt for evidence of persistence on the exposed host itself, including altered startup behaviour, new scheduled execution, and unexpected administrative tooling. If the host is a remote management platform, do not assume compromise stayed local: review adjacent systems for the same authentication source, the same remote execution pattern, or reuse of the same account across multiple assets.

For threat-path mapping, the MITRE ATT&CK Enterprise Matrix is the most direct reference for understanding how command execution, credential access, persistence, and lateral movement typically chain together. On the hardening side, the CIS Benchmarks are useful when you need to verify that the perimeter asset itself is not carrying unnecessary services, weak configuration, or avoidable administration surfaces.

Practitioner Guidance

What to prioritise: Treat the exposed host as a high-risk control point, not just an endpoint. If it can administer other systems, reach it from the internet, or broker authentication, hardening and monitoring it should outrank broad endpoint tuning elsewhere.

Decision rule: If you see suspicious command execution, unusual remote login behaviour, or outbound traffic that does not fit normal administration, assume potential compromise and isolate the host before allowing routine operations to continue. If patching must wait, reduce exposure first by disabling unnecessary remote administration paths and tightening access paths.

What to verify: Confirm that privileged access is genuinely limited, that authentication logs are retained and reviewed, and that segmentation prevents a compromised perimeter host from reaching sensitive systems without explicit approval. If those conditions are not true, the environment is still relying on trust rather than containment.

Practitioner takeaway: CostaRicto defence is mostly about shrinking the value of the perimeter host and increasing the cost of living off it. The goal is to make initial access hard, post-compromise movement noisy, and privileged reach constrained enough that one exposed system cannot become a foothold into the rest of the estate.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?