The cyber attack economy is no longer aiming for the fastest route to money, but the hardest recovery, which is the change every board needs to understand before the next incident occurs.Today’s adversaries, criminal and state alike, design the operation around defeating recovery, and encryption or exfiltration is the closing move rather than the objective.
For a decade, the pattern was consistent: break in, take what you came for, extort or exfiltrate, and leave. Detection and prevention carried most of the security investment in this pattern, because the incident was over almost as soon as it began, and recovery meant restoring last night’s backup. Ransomware crews running REDBIKE (Akira) and AGENDA (Qilin), state-aligned operators like Volt Typhoon, and identity-abuse specialists including UNC3944, have taken that assumption apart, and the operational fingerprints now appear in almost every serious investigation Mandiant and Unit 42 published this year.
Modern intrusions target the recovery estate as a primary objective, whatever the end game. Attackers compromise identity infrastructure first, abuse misconfigured Active Directory Certificate Services templates to mint administrator accounts that survive password rotation, and delete backup objects from cloud storage before any destructive payload fires. Where the hypervisor is exposed, they encrypt the datastore rather than the guests, taking every virtual machine offline in one action. In espionage operations, the equivalent play is BRICKSTORM-class implants on edge appliances that carry no EDR telemetry, achieving dwell times close to 400 days according to Mandiant’s frontline data. Whilst this is a different objective, it demonstrates the same architectural insight, which is to own the recovery layer, and then you own the incident.
The dwell time picture, corrected
However, the narrative that attackers now sit inside networks for months before acting is only half true. Global median dwell time rose to 14 days in 2025 from 11 the year before, across the 500,000 hours of investigation behind M-Trends 2026 (Google Cloud). State espionage operators are the outliers at a median of 122 days, and edge-device implants routinely stretch that towards a year on kit that lacks endpoint visibility.
Financially motivated intrusions, by contrast, move in hours. M-Trends data records the median hand-off from initial access broker to secondary threat crew collapsing from over eight hours in 2022 to 22 seconds in 2025. The mechanics behind that number matter more than the number itself. Three changes have converged: first, the criminal ecosystem has industrialised into specialist tiers. Initial access brokers now sell pre-authenticated footholds to ransomware and extortion crews as a productised service, pre-staging the buyer’s preferred loader or tunnel during the original infection, so the secondary crew inherits a fully instrumented foothold on purchase. Second, initial access techniques themselves have changed. ClickFix social engineering and malvertising now deliver the payload and the follow-on tooling in a single user-initiated action, removing the staging step that used to buy defenders an hour or two of warning. Third, AI has stripped out the operator time that used to sit between access and action, with Unit 42 recovering deployment scripts -whose commenting and fallback logic carry the hallmarks of LLM-assisted development – and reconnaissance running in parallel across hundreds of targets rather than serially against one.
Agentic AI is beginning to impact these patterns, but it is compressing the workflow, not yet running the intrusion. Businesses should trust but verify, as the collapse from hours to seconds is a supply chain effect inside the criminal economy, accelerated by AI, but not caused by it.
The risk has far wider-reaching implications than many businesses are still willing to admit, or understand. There is no reliable clean backup window if the compromise entered through an identity path six weeks ago and has been silently seeded into every image since, and the same is true whether the attacker’s ultimate objective is a ransom, quiet exfiltration, or long-term pre-positioning.
Identity is the perimeter, and it is failing
Unit 42’s 2026 Global Incident Response Report attributes a material role for identity weaknesses in nearly 90% of cases, with 65% of initial access driven by identity-based technique rather than a novel exploit. Voice phishing against IT help desks, session cookie theft and long-lived OAuth token abuse are the standard route in, and they bypass most MFA deployments because the attacker is not defeating the second factor, they are inheriting a legitimate session that already cleared it. Once inside, the adversary uses the same credentials the finance director or the domain administrator uses, and nothing in the SIEM looks wrong until the payload fires or the data appears on a leak site.
AI has changed the economics, not just the physics
Adversaries are using large language models to script deployment at scale, automate parallel reconnaissance across hundreds of targets, and generate convincing pretext for interactive social engineering. As a result, Unit 42 has observed the fastest 25% of intrusions reach exfiltration in 1.2 hours, down from 4.8 hours the year prior. The physics has genuinely shifted too; malware families like PROMPTFLUX now query LLMs mid-execution to evade detection, and QUIETVAULT checks compromised hosts for local AI tooling to accelerate its own reconnaissance. The barrier to running mature tradecraft has dropped, and mid-tier criminal crews now operate with the discipline that used to sit only with state actors.
What resilience must look like
Recovery has to be treated as an investigative discipline, not a restore button. Before any system comes back online, the team needs to establish when the compromise began, which recovery points pre-date the identity foothold, and whether the images themselves contain seeded persistence. That means immutable, air-gapped backups decoupled from the corporate Active Directory domain, log retention extended well beyond the 90 days that BRICKSTORM-class intrusions routinely outlast, and behavioural detection across SaaS integration tokens and hypervisor management planes rather than reliance on static indicators.
Boards need to understand that whilst prevention still matters, the assumption that a breach is a bounded event with a clean rollback can no longer stand. Organisations with the best recovery will be ones who treat backup integrity, identity hygiene and forensic depth as the same problem, which is addressed by the same programme, and funded on the same footing as detection.
Attackers now break in more effectively and have learned to make eviction the hardest and most costly part of the incident, whether that charge is paid in cryptocurrency, competitive advantage, or strategic access held for a rainy day.
Richard Cassidy
Richard Cassidy, CISO for EMEA at Rubrik, is a multifaceted leader with over 25 years of experience in scaling tech start-ups and shaping digital security. Known for his strategic acumen in business operations and customer value, he’s also a recognized authority in cybersecurity and SecOps transformation.
