Welcome to "The Cyber Cyber." In this critical episode, we dive into the alarming reality of modern intrusion speed, focusing on the sophisticated methods employed by "the enterprising adversary"—threat actors who are increasingly "efficient, focused, and business-like in their approach".

Drawing on elite global threat intelligence, we analyze the race against time that cyber defenders now face:

Unprecedented Speed: Breakout time—the moment an adversary moves laterally across a network—hit an all-time low, with the average falling to 48 minutes for eCrime actors, and the fastest observed breakout completing in a shocking 51 seconds. This pace demands immediate, real-time response from defenders.

The Rise of Hands-On Attacks: We detail how adversaries achieve this velocity by abandoning traditional malware in favor of interactive intrusions. In 2024, 79% of detections were malware-free, indicating reliance on hands-on-keyboard techniques that blend in with legitimate user activity. These attacks are increasing, with a 35% year-over-year rise in interactive intrusion campaigns observed.

Social Engineering as a Gateway: Learn how attackers leverage human weakness to gain initial access. We discuss the explosive proliferation of telephone-oriented social engineering, including how voice phishing (vishing) attacks skyrocketed 442% between the first and second half of 2024. We break down tactics used by groups like CURLY SPIDER, who execute high-speed social engineering intrusions using legitimate Remote Monitoring and Management (RMM) tools like Quick Assist to gain persistence in under four minutes.

GenAI as a Force Multiplier: We explore how highly effective adversaries across all categories—eCrime and nation-state—have become "early and avid adopters" of generative AI. GenAI serves as a force multiplier, shortening learning curves and increasing the scale of activities. It is actively used to generate highly convincing content for social engineering, enabling specialized actors like FAMOUS CHOLLIMA (DPRK-nexus) to create fake IT job candidates.

Tune in to understand why prioritizing real-time detection, hardening identity controls, and anticipating the adversary's next move are essential strategies for keeping up with threats that move in less than a minute

The 51-Second Breakout: Tracking the Enterprising Adversary