Loading story…
Mandiant reported that enterprise intrusions are accelerating sharply, with handoffs between initial access brokers and follow-on operators dropping from more than eight hours in 2022 to an average of 22 seconds in 2025. Exploit-based intrusions remain the leading entry vector, while attackers are increasingly using highly interactive voice phishing against IT help desks to bypass MFA and gain access to SaaS environments. The company also said zero-day exploitation is happening faster, with attackers often moving within about seven days before vendors can publish patches, and that AI is being used to support reconnaissance, social engineering, malware development, and credential theft rather than serving as the primary cause of most breaches.
The findings show financially motivated groups prioritizing immediate impact through ransomware, while espionage actors favor stealth and persistence, with median dwell times reaching 122 days in espionage cases. Ransomware operators are increasingly trying to cripple recovery by deleting cloud backup objects, encrypting hypervisor datastores, and targeting virtualization infrastructure. Mandiant said internal detection improved to 52% of 2025 investigations, up from 43% a year earlier, and urged organizations to strengthen identity-centric defenses, train employees and help-desk staff, protect Tier-0, backup, and virtualization assets, extend log retention, and centralize identity governance across SaaS platforms.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
By March 2026, Mandiant publicly released its findings on the 2025 enterprise security landscape, highlighting faster intrusions, increased social engineering, compressed zero-day timelines, and recommendations for stronger identity, backup, and SaaS security controls.
According to Mandiant, organizations detected malicious activity internally in 52% of 2025 investigations, up from 43% in 2024. This indicated some defensive progress despite the broader acceleration in attacker operations.
Mandiant reported that financially motivated attackers increasingly targeted recovery infrastructure in 2025, including deleting cloud backup objects and encrypting hypervisor datastores. The goal was to destroy victims' ability to recover quickly from ransomware incidents.
Mandiant found that highly interactive voice phishing against IT help desks became a major method for bypassing MFA and gaining access to SaaS environments during 2025. The activity reflects attackers' growing focus on identity-centric intrusion paths.
In its M-Trends 2026 findings, Mandiant reported that vulnerability exploitation was the most common initial intrusion vector in 2025, accounting for 32% of investigated cases for the sixth straight year. The report said many of these access vulnerabilities were exploited as zero-days, underscoring the pressure on patching and remediation programs.
The report says attackers in 2025 were exploiting zero-days on average within seven days, often before vendors could publish patches. Exploit-based intrusions remained the leading initial access vector.
Mandiant's 2025 enterprise security findings describe a sharply accelerated threat environment, with compromise hand-offs between attackers shrinking from more than eight hours in 2022 to an average of 22 seconds in 2025. The report also notes wider use of division-of-labor models among cybercriminals.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
zdnet.fr
Open sourceresilientcyber.io
Open sourcezdnet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two 2026 incident-response reports describe threat actors increasingly favoring **fast, low-complexity initial access** over sophisticated exploitation, with **identity compromise** and common remote access paths repeatedly enabling broad downstream impact. Unit 42’s *Global Incident Response Report 2026* data (based on 750+ engagements) indicates attacker activity crossed multiple attack surfaces in **87%** of cases, requiring investigation across endpoints, identity systems, networks, and cloud services; it also attributes a material role to **identity weaknesses** in nearly **90%** of investigations and reports identity-based techniques as the initial access method in **65%** of cases (e.g., phishing, stolen credentials, brute force, insider activity). Phishing and vulnerability exploitation were cited as top initial access vectors (tied at **22%** each), reinforcing that common, repeatable techniques remain highly effective. Arctic Wolf reporting similarly concludes that attackers are prioritizing **accessible entry points**, with **phishing** frequently initiating business email compromise and with ransomware intrusions often beginning via abuse of **remote access services** such as `RDP`, `VPN`, and **remote monitoring and management (RMM)** tooling. Both sources emphasize that weak access controls—such as excessive permissions, non-phishing-resistant MFA, credential reuse/default passwords, IAM misconfigurations, unmanaged OAuth grants, and stale/shared accounts—allow a single foothold to expand laterally across SaaS, cloud, and on-prem environments, increasing blast radius and complicating detection and response.
Jun 29, 2026
Sophos reported that intruders are moving from initial access to high-value targets with increasing speed, with median time to reach **Active Directory** measured in hours rather than days. The company's 2026 Active Adversary Report says attackers frequently exploit exposed remote services, valid accounts, and unpatched edge devices to gain entry, then use built-in administrative tools and hands-on-keyboard activity to expand access while blending into normal operations. The report says ransomware and data-theft operations continue to dominate incident response cases, with adversaries prioritizing credential access, lateral movement, and rapid privilege escalation once inside a network. Sophos said the findings reflect a persistent trend toward shorter breakout times, heavier abuse of legitimate tools, and more disciplined post-compromise tradecraft, increasing pressure on defenders to harden internet-facing systems, monitor identity infrastructure, and accelerate detection and response across the enterprise.
Jul 12, 2026
Sophos reported that identity-focused intrusion methods have overtaken software exploitation as the leading root cause of ransomware incidents, marking a shift in how attackers gain access to victim environments. In its *State of Ransomware 2026* survey of 2,158 IT and cybersecurity leaders across 17 countries whose organizations were hit by ransomware in the past year, malicious email accounted for 26% of attacks, phishing for 24%, and compromised credentials for 23%, while vulnerability exploitation fell to 18% from 32% previously. The findings also showed that 67% of victims said their ransomware incident was the most significant identity attack they faced during the year, underscoring the overlap between ransomware and identity compromise. Sophos said the presence of MFA in 97% of credential-compromise cases indicates that MFA alone often failed to stop intrusions, likely due to incomplete deployment and evolving bypass techniques, and urged organizations to strengthen identity threat detection, credential auditing, segmentation, **ZTNA**, and continuous detection and response alongside patch management.
Jul 26, 2026