Loading story…
CrowdStrike’s 2026 Global Threat Report reported that in 2025 adversaries took 29 minutes on average to move from initial access to lateral movement (“breakout”) inside victim environments, representing a 65% acceleration versus the prior year. The report also cited extreme cases, including a 27-second breakout and an instance where data exfiltration began within four minutes of initial compromise, underscoring that intrusion speed is increasingly central to attacker success and evasion.
The findings were attributed to a combination of credential misuse, increased attacker efficiency (including the use of AI-enabled tooling), and persistent defensive blind spots that reduce detection and response windows. DataBreaches.net amplified the same CrowdStrike metrics and pointed readers back to the Dark Reading coverage, reinforcing the operational implication for defenders: response processes and controls must assume materially shorter dwell times between initial compromise and impactful actions (lateral movement and exfiltration).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
CrowdStrike released its 2026 Global Threat Report, framing 2025 as the 'year of the evasive adversary' and emphasizing faster breakout times, identity abuse, AI-enabled operations, cloud targeting, and zero-day exploitation. Multiple outlets summarized the report's findings after publication.
During 2025 threat monitoring, CrowdStrike said attackers exploited CVE-2025-3248 in Langflow, including in ransomware-related activity. It also reported a spoofed Postmark MCP server published to npm to harvest sensitive data and malicious prompt injections observed at at least 90 organizations.
CrowdStrike reported that AI-enabled adversary activity rose 89% in 2025, while cloud-conscious intrusions increased 37% overall and 266% among state-nexus actors. The report also highlighted a 42% year-over-year increase in zero-day exploitation, especially against edge devices with limited visibility.
Across 2025 investigations, CrowdStrike reported that 82% of detections were malware-free and that valid-account abuse featured heavily in cloud incidents, including 35% of cloud-related cases. The findings described attackers using trusted identity flows, SSO, SaaS integrations, and cross-domain movement to evade detection.
In its analysis of 2025 threat activity, CrowdStrike found the average time from initial compromise to lateral movement fell to 29 minutes, a 65% year-over-year acceleration. The company also recorded a fastest observed breakout of 27 seconds and one case where data exfiltration began four minutes after initial access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcetechtarget.com
Open sourcecsoonline.com
Open sourcecardinalops.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that enterprise intrusions are accelerating sharply, with handoffs between initial access brokers and follow-on operators dropping from more than eight hours in 2022 to an average of **22 seconds** in 2025. Exploit-based intrusions remain the leading entry vector, while attackers are increasingly using highly interactive voice phishing against IT help desks to bypass **MFA** and gain access to **SaaS** environments. The company also said zero-day exploitation is happening faster, with attackers often moving within about **seven days** before vendors can publish patches, and that AI is being used to support reconnaissance, social engineering, malware development, and credential theft rather than serving as the primary cause of most breaches. The findings show financially motivated groups prioritizing immediate impact through ransomware, while espionage actors favor stealth and persistence, with median dwell times reaching **122 days** in espionage cases. Ransomware operators are increasingly trying to cripple recovery by deleting cloud backup objects, encrypting hypervisor datastores, and targeting virtualization infrastructure. Mandiant said internal detection improved to **52%** of 2025 investigations, up from 43% a year earlier, and urged organizations to strengthen identity-centric defenses, train employees and help-desk staff, protect Tier-0, backup, and virtualization assets, extend log retention, and centralize identity governance across SaaS platforms.
Jun 29, 2026
Sophos reported that intruders are moving from initial access to high-value targets with increasing speed, with median time to reach **Active Directory** measured in hours rather than days. The company's 2026 Active Adversary Report says attackers frequently exploit exposed remote services, valid accounts, and unpatched edge devices to gain entry, then use built-in administrative tools and hands-on-keyboard activity to expand access while blending into normal operations. The report says ransomware and data-theft operations continue to dominate incident response cases, with adversaries prioritizing credential access, lateral movement, and rapid privilege escalation once inside a network. Sophos said the findings reflect a persistent trend toward shorter breakout times, heavier abuse of legitimate tools, and more disciplined post-compromise tradecraft, increasing pressure on defenders to harden internet-facing systems, monitor identity infrastructure, and accelerate detection and response across the enterprise.
Jul 12, 2026
Threat actors increasingly abused *legitimate AI tools* and automation to accelerate intrusions, with CrowdStrike reporting an **89% YoY increase in AI-enabled adversary activity** and an average eCrime breakout time dropping to **29 minutes** (fastest observed **27 seconds**). CrowdStrike also described attackers poisoning or hijacking local AI tooling via **malicious JavaScript embedded in npm packages** targeting tools such as *Claude* and *Gemini* to steal credentials and crypto assets, and highlighted a **CHATTY SPIDER** intrusion that began with voice phishing and remote access via **Microsoft Quick Assist**, followed by attempted exfiltration using **WinSCP** and a fallback to **Google Drive** when blocked. Separate reporting detailed additional active campaigns and exploitation trends consistent with faster initial access and persistence: **UAC-0050 (DaVinci Group / “Mercenary Akula”)** used spear-phishing with spoofed Ukrainian judicial themes and multi-layer archives (ZIP→RAR→passworded 7z) to deliver an `*.pdf.exe` dropper that installed **Remote Manipulator System (RMS)** for remote control and file transfer against a European financial institution. **UnsolicitedBooker** shifted targeting to telecoms in Kyrgyzstan and Tajikistan, using phishing documents that prompt “Enable Content” to run macros that drop loaders (e.g., **LuciLoad**, **MarsSnakeLoader**) and deploy **LuciDoor** and **MarsSnake** backdoors. Vulnerability intelligence for January 2026 also warned of **active exploitation** including **APT28** use of a Microsoft Office zero-day (**CVE-2026-21509**) via weaponized RTFs to deliver implants (e.g., **Covenant**), alongside multiple critical authentication-bypass and RCE issues affecting enterprise platforms—reinforcing that adversaries are combining rapid social engineering, supply-chain style delivery, and exploited vulnerabilities to compress dwell time and speed lateral movement.
Jun 29, 2026