Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones
Opinion piece argues attackers prioritize repeatable playbooks like ClickFix (47% of Microsoft-notified attacks) and living-off-the-land over novel techniques.
The column analyzes why commodity techniques scale: Microsoft observed ClickFix as the top initial access method at 47% of its notifications last year, while Bitdefender found 84% of 700,000 analyzed high-severity incidents involved binaries already present on machines. Verizon's DBIR shows vulnerability exploitation rising to 31% of initial access vectors, up from 20%, and ransomware leak-site rankings show Qilin (roughly 1,600 claimed victims) and The Gentlemen (121 claimed victims in June) competing on throughput. The author argues attackers behave like a generics business, standardizing repeatable procedures rather than investing in novel tradecraft.
- ClickFix accounted for 47% of attacks in Microsoft's notifications last year
- 84% of Bitdefender's high-severity incidents used already-present administrative binaries
- Vulnerability exploitation reached 31% of DBIR initial access vectors, up from 20%
- Ransomware groups like Qilin and The Gentlemen compete on victim throughput
- Vendors
- MicrosoftBitdefenderVerizon
- Threat actors
- QilinThe Gentlemen
From the original article
10 min read at thehackernews.com
A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.