Loading story…
Sophos reported that intruders are moving from initial access to high-value targets with increasing speed, with median time to reach Active Directory measured in hours rather than days. The company's 2026 Active Adversary Report says attackers frequently exploit exposed remote services, valid accounts, and unpatched edge devices to gain entry, then use built-in administrative tools and hands-on-keyboard activity to expand access while blending into normal operations.
The report says ransomware and data-theft operations continue to dominate incident response cases, with adversaries prioritizing credential access, lateral movement, and rapid privilege escalation once inside a network. Sophos said the findings reflect a persistent trend toward shorter breakout times, heavier abuse of legitimate tools, and more disciplined post-compromise tradecraft, increasing pressure on defenders to harden internet-facing systems, monitor identity infrastructure, and accelerate detection and response across the enterprise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos released its 'Nowhere, man: The 2026 Active Adversary Report' blog post, presenting findings from its threat research on active adversary behavior. No earlier discrete events are described in the provided reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that enterprise intrusions are accelerating sharply, with handoffs between initial access brokers and follow-on operators dropping from more than eight hours in 2022 to an average of **22 seconds** in 2025. Exploit-based intrusions remain the leading entry vector, while attackers are increasingly using highly interactive voice phishing against IT help desks to bypass **MFA** and gain access to **SaaS** environments. The company also said zero-day exploitation is happening faster, with attackers often moving within about **seven days** before vendors can publish patches, and that AI is being used to support reconnaissance, social engineering, malware development, and credential theft rather than serving as the primary cause of most breaches. The findings show financially motivated groups prioritizing immediate impact through ransomware, while espionage actors favor stealth and persistence, with median dwell times reaching **122 days** in espionage cases. Ransomware operators are increasingly trying to cripple recovery by deleting cloud backup objects, encrypting hypervisor datastores, and targeting virtualization infrastructure. Mandiant said internal detection improved to **52%** of 2025 investigations, up from 43% a year earlier, and urged organizations to strengthen identity-centric defenses, train employees and help-desk staff, protect Tier-0, backup, and virtualization assets, extend log retention, and centralize identity governance across SaaS platforms.
Jun 29, 2026
Two 2026 incident-response reports describe threat actors increasingly favoring **fast, low-complexity initial access** over sophisticated exploitation, with **identity compromise** and common remote access paths repeatedly enabling broad downstream impact. Unit 42’s *Global Incident Response Report 2026* data (based on 750+ engagements) indicates attacker activity crossed multiple attack surfaces in **87%** of cases, requiring investigation across endpoints, identity systems, networks, and cloud services; it also attributes a material role to **identity weaknesses** in nearly **90%** of investigations and reports identity-based techniques as the initial access method in **65%** of cases (e.g., phishing, stolen credentials, brute force, insider activity). Phishing and vulnerability exploitation were cited as top initial access vectors (tied at **22%** each), reinforcing that common, repeatable techniques remain highly effective. Arctic Wolf reporting similarly concludes that attackers are prioritizing **accessible entry points**, with **phishing** frequently initiating business email compromise and with ransomware intrusions often beginning via abuse of **remote access services** such as `RDP`, `VPN`, and **remote monitoring and management (RMM)** tooling. Both sources emphasize that weak access controls—such as excessive permissions, non-phishing-resistant MFA, credential reuse/default passwords, IAM misconfigurations, unmanaged OAuth grants, and stale/shared accounts—allow a single foothold to expand laterally across SaaS, cloud, and on-prem environments, increasing blast radius and complicating detection and response.
Jun 29, 2026
CrowdStrike’s *2026 Global Threat Report* reported that in 2025 adversaries took **29 minutes on average** to move from initial access to lateral movement (“breakout”) inside victim environments, representing a **65% acceleration** versus the prior year. The report also cited extreme cases, including a **27-second** breakout and an instance where **data exfiltration began within four minutes** of initial compromise, underscoring that intrusion speed is increasingly central to attacker success and evasion. The findings were attributed to a combination of **credential misuse**, increased attacker efficiency (including the use of **AI-enabled tooling**), and persistent defensive blind spots that reduce detection and response windows. DataBreaches.net amplified the same CrowdStrike metrics and pointed readers back to the Dark Reading coverage, reinforcing the operational implication for defenders: response processes and controls must assume materially shorter dwell times between initial compromise and impactful actions (lateral movement and exfiltration).
Jun 29, 2026