Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones – CYBERDEFENSA.MX
admin Noticias, Trending
Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones – CYBERDEFENSA.MX

The most common way into a company last year was to ask.

A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting for 47% of the attacks in their notifications. Nothing arrives as an attachment, so there is nothing to scan. No vulnerability is used, so there is nothing to patch.

What happens next is just as ordinary. When Bitdefender analyzed 700,000 security incidents, 84% of the high-severity ones involved binaries that were already on the machine – the same administrative tools your IT team uses every day. Nothing malicious was installed, because nothing malicious was needed.

Neither technique is clever, but both are winning. And the reason is not that attackers have run out of ideas. It is that they are not looking for ideas. They are looking for something that works the same way at the next company, and the one after that.

This is a business, and businesses standardize

A criminal group that has to invent something new for every victim does not scale. One that has a procedure – a formula it can run against a list of targets, with predictable steps and a predictable result – can grow as fast as it can find targets.

You can watch that preference in the data. Verizon’s most recent Data Breach Investigations Report makes the exploitation of vulnerabilities “the most prominent initial access vector in our dataset this year, reaching the height of 31%, up from 20% last year” – a 55% increase in a single year, in the one category that rewards scanning over skill.

Edge devices are not popular because they are interesting. They are popular because the procedure is short enough to write on a card.

Watch for new CVEs in internet-facing devices. Filter for the ones that give remote code execution and require no authentication – the easy ones. Then wait. Someone will publish a working proof of concept on GitHub, usually within days. When they do, scan the internet at scale and take whatever has not been patched yet.

Notice what is absent from that procedure. Nobody in that chain develops anything. The exploit arrives free, from a researcher, on a public repository, on a schedule somebody else sets. The only capability required is the ability to run other people’s code quickly and at volume. Exposure becomes the selection criterion, and who the victim turns out to be stops mattering very much.

There is a version of this in the legitimate economy. A generics manufacturer does not discover drugs. It waits for someone else’s research to become public, then produces a known formula at volume, competing on cost and speed to market rather than on invention. That is what this is. Not a research operation – a generics business, where the patent expires the day the proof of concept lands on GitHub.

You can also see the preference in who wins. For more than a year, the top position on the ransomware leak-site rankings belonged to Qilin, which claimed roughly 1,600 victims across that span, usually more than a hundred a month. In June it was displaced by The Gentlemen, with 121 claimed victims against Qilin’s 80. These are figures the groups publish about themselves, so they are claims rather than audited numbers – but the two have been trading the top position, and what they are competing on is throughput. The leaderboard counts victims, it does not count technical achievement.

The more telling detail is where the challenger came from. The Gentlemen branched out from a former Qilin affiliate, and as Bitdefender’s own threat debrief put it, they have demonstrated how successful ransomware “playbooks” are being recycled and improved. The procedure walked out of one organization and into another and worked just as well in new hands.

That is the clearest available statement of what these groups actually own. Not an exploit, not a tool, not a secret. A method that can be written down, handed over, and run again.

ClickFix is a playbook for getting in

Look at ClickFix through that lens and its appeal is obvious.

There is no payload to rebuild when a detection lands, because there is no payload. There is no exploit to re-develop when a vendor ships a patch, because no vulnerability is being used. When a lure stops working, you rewrite the text on a web page. The technique degrades gracefully, which is exactly what you want from something you intend to run thousands of times.

It also works identically everywhere, because it does not depend on the target’s technology stack at all. It depends on a person being willing to follow instructions, and that is the one component present in every environment on earth, in the same version, with no patch available.

The fact that it also removes every artifact a defense is designed to catch – nothing to scan, no exploit to detect, no signature to match – is a genuine advantage. But I would not put it first. Attackers did not choose this because it evades detection. They chose it because it repeats, and the evasion came free.

Living off the land is the same idea, one step further in

Initial access is just the beginning of the operation. The work that follows – the part that ends in stolen data or encrypted systems – runs on the same logic: a playbook that produces the same result wherever it is pointed. Only this time the tools are the ones already on the machine.

Rather than bringing tooling of their own, they use what is already installed: the scripting engines, remote management utilities, archive tools and administrative binaries that ship with the operating system. That is what the 84% describes – those binaries were involved in the large majority of high-severity incidents we analyzed.

The reason is not primarily stealth. It is that these tools are familiar, they are present in every environment, and – this is the part that matters – they are identical in every environment. An operator who learns the sequence once can run it at the next victim without adaptation. There is nothing to port, nothing that depends on the target’s build, and nothing that needs testing against an unfamiliar stack. Command and control follows the same instinct, routed through cloud services the organization already trusts and already permits.

That these tools are also hard to distinguish from legitimate administration is a considerable bonus. It is not the reason they were picked.

It is, however, the part defenders find hardest, and it is worth being honest about why. When an attacker introduces nothing, there is nothing to find.

The economics look exactly like you would expect

If cybercrime really is a volume business built on repeatable procedure, the financial picture should look like a volume business under pressure. And it does.

Verizon’s most recent report has ransomware growing again, to 48% of all breaches, up from 44% the year before. Over the same period, the money moved the other way: 69% of ransomware victims didn’t pay, and the median ransom that was paid fell to $139,875 from $150,000. Bitdefender’s own tracking of ransomware leak sites counted 704 organizations claimed as victims in June 2026 alone.

More victims, less money. That is falling revenue per attempt, and the rational response to falling revenue per attempt is not to make each attempt more elaborate. It is to make each attempt cheaper and more repeatable, and to run more of them.

This is also where the AI argument meets arithmetic. The playbook approach costs an attacker close to nothing per attempt: the scanning is cheap, the exploit was free, and the tools were already installed on the victim’s machine. Putting a model in that loop adds a real cost to every attempt, in a business that has spent years driving that cost towards zero. It also adds it in the wrong place. This is a volume operation aimed at whoever happens to be exposed, not a small number of large organizations where a bigger investment per target could be justified. Against a handful of high-value victims, paying for intelligence might well pay back. Against a list of several thousand small businesses, it does not.

Which is why autonomy is the wrong shape for this business

That is the arithmetic objection. The structural one runs deeper.

An autonomous agent improvises. It explores an environment, finds a path, and the path it finds is particular to that environment. Run it against the next company and it does something different. That is genuinely impressive, and it is precisely the opposite of a playbook.

Ransomware operates as an affiliate model. The whole point of a franchise is that a procedure written once produces the same result in unfamiliar hands. Variance is the enemy of that model – you cannot document an improviser, cannot train an affiliate on it, and cannot predict what it will do at a victim you have not seen. A tool that solves each problem differently is not an asset to a business whose entire advantage is doing the same thing every time.

There is a version of AI adoption here that is entirely rational, and I expect it is already happening: using a model offline to help develop the playbook – research a technique, write the tooling, refine the lure – and then running the resulting procedure deterministically, the way it has always been run. That is AI as author. What does not follow the money is AI as executor, live at each victim, improvising its way in.

The same reasoning applies to the claim that AI will let attackers find novel vulnerabilities. They already decline to invest there, and they decline for a reason. The edge-device procedure works precisely because someone else does that work and publishes it, free, on a predictable cadence. A capability that discovers original vulnerabilities solves a problem this business does not currently have – and it would have to be cheaper than waiting, which is hard to beat when waiting costs nothing.

None of this holds permanently, and I have said so in January as well as here. Attackers adopted ransomware-as-a-service and double extortion the moment those made business sense, quickly and without sentiment, and they will adopt autonomy on the same terms. But the signal to watch is not a capability announcement. It is the point at which running a model against a victim becomes cheaper than running the playbook – because cost is the only threshold this business has ever responded to.

What actually helps

The encouraging consequence of all this is that a standardized attack is a standardized defense problem. You are not defending against unlimited creativity. You are closing a small number of doors that the playbook depends on, and the playbook cannot afford to be redesigned for every victim.

Patch smart. You cannot patch everything quickly, and you do not have to. The attacker’s filter is public: internet-facing, remote code execution, no authentication required. Run that same filter over your own estate, and you have your list. The window is the gap between the advisory being published and the first working proof of concept appearing on GitHub – often only days. Patch inside that window and the procedure described earlier never reaches you.

Reduce what can run at all. Application control and script execution policy break the ClickFix chain at the point where a pasted command becomes a running process.

Scope the built-in tools. Most users have no legitimate need for the remote management and scripting utilities that turn up in the 84%. They cannot be removed, but who can invoke them is a decision you get to make.

Treat identity as the real perimeter. Shared credentials, over-broad service accounts and keys that are administrative everywhere are what convert one compromised machine into an incident. The least fashionable item on this list, and consistently the most decisive.

Look at events together, not one at a time. Nothing in a living-off-the-land attack looks wrong on its own. A remote management tool running is normal. That account being signed in is normal. That machine talking to cloud storage is normal. What is not normal is those three things happening in that order, on that host, at that hour. A tool that checks each one on its own will clear all three.

And make sure somebody is actually watching. This is the one I would put money on. In the investigations Bitdefender’s own incident response and MDR teams run, the same two findings come up again and again: either there was no endpoint detection deployed at all, or it was deployed and nobody was monitoring it – no security operations team, no managed service, nothing at the other end. A third version is the most frustrating, because it looks like success from the outside: the tooling works, the alert is raised, and it reaches nobody with the authority to stop what is happening. Detection that nobody is watching is not detection. It is a log file you will read afterward.

What they are actually shopping for

I would put it this way. Attackers are not shopping for a Lamborghini. They want a Toyota – something that starts every morning, that anyone on the crew can drive, that can be serviced anywhere, and that does the same job tomorrow as it did today. That is what ClickFix is. That is what living off the land is. Neither is impressive, and both are dependable, which is the only specification that matters when you are doing this ten thousand times.

Whatever attackers eventually do with AI, they will adopt it on exactly those terms: not when it becomes capable, but when it becomes cheaper than what already works. Until then, the doors they are actually walking through are the ones we can close.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Attackers Don’t Just Send Phishing Emails. They Weaponize Your SOC’s Workload – CYBERDEFENSA.MX
admin Noticias, Trending
Attackers Don’t Just Send Phishing Emails. They Weaponize Your SOC’s Workload – CYBERDEFENSA.MX

The most dangerous phishing campaigns aren’t just designed to fool employees. Many are designed to exhaust the analysts investigating them. When a phishing investigation takes 12 hours instead of five minutes, the outcome can shift from a contained incident to a breach.

For years, the cybersecurity industry has focused on the front door of phishing defense: employee training, email gateways that filter known threats, and reporting programs that encourage users to flag suspicious messages. Far less attention has been paid to what happens after a report is filed, and how attackers exploit the investigation process that follows. 

Alert fatigue in Security Operations Centers isn’t just an operational inconvenience. It can become an attack surface. SOC teams increasingly report phishing campaigns that appear designed not only to compromise targets but also to overwhelm the analysts responsible for investigating them. 

This shifts how organizations should think about phishing defense. The vulnerability isn’t just the employee who clicks. It’s also the analyst who can’t keep up with the queue. When investigations that should close in minutes stretch to 3, 6, or 12 hours because of queue congestion, the window for attacker success widens dramatically.

When Phishing Volume Becomes a Weapon

Phishing is often treated as a series of independent threats. One message. One potential victim. One investigation. Attackers operating at scale think in terms of systems, not individual messages. A SOC is one of those systems, and it has finite capacity and predictable failure modes.

Consider a phishing campaign targeting a large enterprise. The attacker sends thousands of messages. Most are low-sophistication lures that email gateways or trained employees will likely catch. These messages flood the SOC with reports and alerts. Analysts begin triaging, working through a queue that grows faster than they can clear it.

Buried in that volume are a few carefully crafted spear-phishing messages targeting individuals with access to critical systems. These messages are the real payload. The flood is not just a numbers game. It is effectively a denial-of-service attack against the SOC’s attention, sometimes referred to as an Informational Denial-of-Service (IDoS).

This pattern is not purely theoretical. Red team exercises and incident reports have documented adversaries who time high-volume phishing campaigns to coincide with targeted spear-phishing attempts. The commodity wave creates noise. The targeted message hides inside it. 

The Predictable Failure Mode

This tactic works because SOC phishing triage tends to follow a predictable pattern across organizations. When phishing report volume spikes, most SOCs respond in predictable ways. Analysts begin triaging faster, spending less time per submission. Investigation depth decreases. Industry research shows 66% of SOC teams cannot keep up with incoming alerts. The focus shifts from thorough investigation to clearing the queue. Managers may deprioritize phishing reports relative to alerts from other detection systems, assuming user-submitted reports are lower fidelity.

Each response is rational on its own. Together, they create the conditions an attacker needs.

SOC managers observe a consistent pattern during high-volume periods: decision quality drops as workload increases. Analysts begin anchoring on superficial indicators. Messages that «look like» previously benign submissions receive less scrutiny. Novel indicators of compromise may be overlooked when they appear in a crowded queue rather than in isolation.

The attacker’s advantage compounds because the most dangerous messages are specifically designed to exploit these shortcuts. A spear-phishing email targeting the CFO’s executive assistant doesn’t arrive looking dramatically different from everything else in the queue. It’s crafted to resemble the category of messages that analysts, under pressure, have learned to move past quickly — a vendor communication, a document-sharing notification, a routine business process email.

The Economics Behind the Attack

The economics of this dynamic heavily favor the attacker. Generating thousands of commodity phishing emails costs almost nothing, especially with generative AI lowering the production barrier further. But each of those emails, once reported by an employee, costs the defending organization real analyst time and cognitive bandwidth.

This creates an asymmetry that traditional SOC models have no good answer for:

  • Attacker cost per decoy email: near zero. Template-based generation, commodity infrastructure, automated delivery.
  • Defender cost per reported email: minutes of skilled analyst time for even a cursory review. Hours if the investigation is thorough.
  • Attacker cost for the real payload: moderate — these are the carefully researched, individually crafted messages designed for specific targets.
  • Defender cost of missing the payload: potentially catastrophic — credential compromise, lateral movement, data exfiltration, ransomware deployment.

The defender is forced to investigate everything because the cost of missing a real threat is so high. The attacker knows this and uses it to drain investigative resources before the real attack arrives. It’s an attrition strategy applied to human attention rather than system availability.

This asymmetry has only worsened as organizations have scaled up phishing awareness programs. More trained employees means more reports. More reports means more queue pressure. More queue pressure means less attention per investigation. The very success of security awareness training has, paradoxically, expanded the attack surface that adversaries exploit.

The Real Problem is Decision Speed

Most security tools respond to this challenge by throwing more alerts at people — additional detection layers, more threat feeds, extra scoring systems. More data without better decision processes only compounds the overload. The fundamental issue isn’t that SOCs lack information about suspicious emails. It’s that they lack the ability to turn that information into clear, confident decisions at the speed the threat environment demands.

The organizations breaking out of this cycle are reframing phishing triage not as an email analysis problem but as a “decision precision” problem. The goal isn’t to generate more signals about a suspicious message. It’s to deliver a decision-ready investigation — a complete, reasoned verdict that tells the analyst exactly what was found, what it means, and what should happen next — so that no one has to guess.

This distinction matters because guessing is exactly what overwhelmed analysts are forced to do. When the queue is deep and investigation time is compressed, analysts make judgment calls based on incomplete analysis. Sometimes they’re right. Sometimes they’re not. And the attacker’s entire strategy depends on those moments when they’re not.

Decision-ready investigation changes the equation. Instead of presenting analysts with raw indicators and expecting them to assemble a conclusion under time pressure, the system delivers a synthesized assessment with clear reasoning. The analyst’s role shifts from doing the investigation to reviewing the investigation — a fundamentally different cognitive task that scales far more effectively under volume.

Why Rule-Based Automation Doesn’t Solve This

The obvious response is automation, and most SOCs have implemented some version of it. Auto-closing reports from whitelisted senders. Deduplicating identical submissions. Applying basic reputation checks to filter known-safe domains.

These measures help with baseline volume but fail against the specific threat model described above — and in some cases, they make it worse.

Rule-based filters create predictable blind spots. If an attacker knows (or can infer) that an organization auto-closes reports from domains with established reputation, they can compromise or spoof those domains. If deduplication logic groups messages by subject line or sender, an attacker can vary these superficially while maintaining the same malicious payload.

There’s also the trust problem. Security teams are rightfully skeptical of «black box» automation that renders verdicts without showing its work. When an automated system closes a phishing report, and no one can explain exactly why, confidence erodes. Analysts second-guess the automation, re-investigate cases it already handled, or override its decisions reflexively. The efficiency gains evaporate, and the organization ends up with the worst of both worlds: automation it’s paying for and manual processes it can’t abandon.

More fundamentally, static rules can’t adapt to the dynamic relationship between attack patterns and SOC behavior. The attacker’s strategy isn’t static. It continuously evolves based on what works. A defensive system built on fixed rules is playing a static game against a dynamic adversary.

Specialized Investigation Agents, Not Black Boxes

The emerging approach to adversarial phishing defense looks less like a single automated tool and more like a coordinated team of specialized experts — each focused on a specific dimension of the investigation and each capable of explaining exactly what it found and why it matters.

In practice, this means agentic AI architectures where distinct analytical agents handle different parts of a phishing investigation simultaneously. One agent verifies sender authenticity — checking SPF, DKIM, and DMARC records, analyzing domain registration history, and evaluating whether the sending infrastructure matches the claimed identity. Another examines the message itself, analyzing linguistic patterns, tone inconsistencies, and social engineering indicators that suggest manipulation rather than legitimate communication. A third correlates the report with endpoint telemetry, determining whether the recipient’s device has exhibited any behavioral anomalies that might indicate a payload has already executed.

These agents don’t operate independently and disappear into a verdict. They produce transparent, auditable reasoning — a clear chain of evidence showing which indicators were evaluated, what was found, and how those findings contributed to the final assessment. When the system determines a message is benign, it shows why. When it flags a message as malicious, it presents the specific evidence. When signals conflict, it explains the ambiguity and escalates with full context.

This transparency is what separates decision-ready investigation from black box automation. An analyst reviewing an AI-generated investigation can see the logic, challenge the reasoning, and build calibrated trust in the system over time. That trust is what ultimately allows organizations to let the system handle routine verdicts autonomously — not blind faith in an opaque algorithm, but earned confidence in a process that shows its work.

The Five-Minute Reality

The practical impact of this approach comes down to time — specifically, the difference between the 3-to-12-hour investigation timelines that characterize most manual SOC phishing workflows and the sub-five-minute resolution that decision-ready AI triage enables.

This gap is not only an efficiency metric. It directly affects security outcomes. In 12 hours, a compromised credential can be used for lateral movement, privilege escalation, and data staging. In five minutes, the same credential gets revoked before the attacker establishes persistence. A “non-event.” The same phishing email produces radically different consequences depending entirely on how fast the investigating organization reaches a confident decision.

When cognitive AI handles initial investigation, every submission gets the same rigorous, multi-dimensional analysis regardless of queue depth or time of day. The commodity phishing flood designed to exhaust analysts gets absorbed by a system that doesn’t fatigue. The carefully crafted spear-phish designed to blend in during high-volume periods receives the same thorough investigation as every other submission, with cross-submission pattern detection that might flag it precisely because of its relationship to the surrounding volume.

The human analysts, the experienced, skilled professionals that every SOC depends on, shift from reactive queue processing to the work that genuinely requires human judgment: investigating confirmed incidents, hunting for threats that haven’t triggered alerts, and making strategic decisions about defensive posture.

Measuring SOC Resilience

Organizations that adopt this framing need metrics that reflect it. Traditional SOC metrics, such as mean time to acknowledge, mean time to close, and tickets processed per analyst, measure operational efficiency. They don’t measure resilience against adversarial exploitation.

Metrics that capture defensive resilience against weaponized volume include:

  • Investigation quality consistency under load. Does analytical depth remain constant as report volume increases, or does it degrade? Tracking investigation thoroughness across volume quartiles reveals whether the SOC’s phishing triage is exploitable under pressure.
  • Decision latency. How quickly does the triage system move from alert receipt to confident verdict? The gap between 12 hours and 5 minutes isn’t an incremental improvement; it’s a categorical change in attacker opportunity.
  • Escalation accuracy at volume. When the queue is heavy, are the right cases being escalated to human analysts? Rising false negative rates during high-volume periods indicate exactly the vulnerability attackers target.
  • Decision transparency rate. What percentage of automated verdicts include complete, auditable reasoning? Black box resolutions that can’t be explained are resolutions that can’t be trusted, and untrusted automation gets overridden, negating its value.
  • Proactiveness. How close to the point of impact are threats being identified?

Changing the Defensive Equation

The attacker’s advantage in weaponizing SOC workload depends on a specific assumption: that increasing phishing volume reliably degrades defensive quality. If that assumption holds, the strategy is highly effective and nearly free to execute. If it doesn’t — if investigative quality and speed remain constant regardless of volume — the entire approach collapses.

The commodity phishing flood no longer provides cover because every message receives the same analytical rigor in the same five-minute window. The carefully crafted spear-phish no longer benefits from a rushed analyst because no analyst is rushing. The asymmetry flips: the attacker spent resources generating noise that achieved nothing, while the defender’s capacity for genuine threat detection remained intact.

The strategic value of decision-ready AI triage is not just efficiency. It removes a failure mode that attackers have learned to exploit. It turns a predictable vulnerability into a defensive strength, making the SOC’s phishing workflow resilient against the very tactic designed to break it.

The phishing report button stays. Employees keep reporting. But the investigation engine behind that button no longer offers attackers a lever to pull.

Conifers.ai’s CognitiveSOC platform uses agentic AI to deliver decision-ready phishing investigations in minutes, not hours. Learn more about how the Conifers platform is designed to reduce the alert-fatigue conditions attackers often exploit.

Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.