INTEL-13: Every Wall Has a Door

The INTEL  

Twelve FIR Risk INTEL posts. Eight independent research teams. One converging conclusion: the traditional enterprise security model — perimeter defense, signature detection, severity-based triage — is being systematically dismantled from every direction simultaneously.

Not by a single threat. Not by a single technique. By a structural shift in how attacks work.

Your perimeter is irrelevant. Attackers use your own infrastructure as the attack platform. Microsoft login pages are the phishing pages — EvilGinx2 proxies sit between your employees and Microsoft’s real authentication portal, and there’s nothing for your URL filter to catch ( INTEL-5). Muddled Libra calls your help desk, resets a password, and uses Microsoft Graph API to own your cloud environment from the inside ( INTEL-4). Your firewall never sees it. Your EDR never catches it. Every action uses legitimate services doing exactly what they were designed to do.

Your triage model is broken. In 2022, the median handoff between initial access and ransomware was over 8 hours. Today it’s 22 seconds — a 1,300x compression ( INTEL-9). The browser infection your SOC would triage tomorrow morning has already become a ransomware deployment. The distinction between “precursor event” and “attack” has collapsed.

Your intelligence model can’t scale. 109 active ransomware groups — a 49% year-over-year increase ( INTEL-10). They’re not sophisticated. They don’t need to be. Generic leaked toolkits, commodity techniques, opportunistic targeting. You can’t track TTPs for 109 groups. Attribution-based defense is dead.

Your threat model is inverted. Credential theft is now at 23% prevalence — double the rate of encryption ( INTEL-7). The most damaging attacks produce no alert, no business interruption, no ransom note. Identity attacks surged 850% in a single year ( INTEL-11) — confirmed across six independent reports as the dominant attack vector. The thing your risk register ranks highest may no longer be the thing that hurts you most.

Your detection is being outsmarted. Malware now performs trigonometric analysis of mouse cursor movements to determine if it’s in a sandbox or on a human’s machine ( INTEL-6). A “clean” sandbox verdict may mean the file is more sophisticated than your analysis environment. And voice phishing — which bypasses every technical control in the email security stack — accounts for 23% of cloud compromises ( INTEL-8). There is no URL to scan, no attachment to detonate, no domain to block.

Five walls. Five doors. All open at the same time.

Why It Matters  

Any one of these shifts would warrant a strategic reassessment. All five happening simultaneously is different — it’s a structural failure of the security model most enterprises are still operating under.

The model assumed perimeters could be defended. Attackers use your infrastructure. The model assumed triage buys time. Twenty-two seconds. The model assumed intelligence tracks threats. One hundred nine groups. The model assumed encryption is the risk. Credential theft is twice as common. The model assumed detection catches threats. The threats test your detection first.

The organizations running 2023 playbooks against 2026 threats aren’t just behind — they’re operating under assumptions the adversary has already invalidated.

But there is a counterweight. And it’s the most important finding across all twelve reports.

What To Do  

The defender’s window is still open — but it won’t be for long.

Red Canary’s analysis of 110,000 threats found that AI-powered attacks “represent an evolution in tooling, not a revolution in attack techniques.” IBM confirms AI “has not changed the fundamentals of cyberattack campaigns.” Defenders have better data access, larger telemetry volumes, and more to gain from AI-powered automation than attackers do ( INTEL-12).

This advantage is temporary. Use it now to close the five doors:

→ Automate identity defense at scale. The 850% surge means prevention alone has failed. Deploy continuous behavioral baselines that detect anomalous access patterns post-authentication. The credential will be compromised. The question is how much damage it can do.

→ Kill the triage delay. Build automated correlation rules that escalate initial access indicators — FAKEUPDATES, drive-by downloads on critical-access endpoints — to ransomware-level urgency. At 22 seconds, your response must be automated.

→ Shift from attribution to behavior. With 109 groups using commodity toolkits, stop building detection for named threat actors. Build detection for file encryption behavior, credential dumping patterns, and anomalous API usage. The attacker’s identity doesn’t matter. Their behavior does.

→ Monitor your own infrastructure as an attack surface. Baseline Microsoft Graph API usage, OAuth token grants, device code authentication flows, and cloud role assignments. The attack uses your legitimate services. Detection requires behavioral analytics against your own environment’s norms.

→ Treat “nothing happened” as a finding. When suspicious files execute cleanly in your sandbox, escalate. When your security tools report no alerts during unusual account activity, investigate. The absence of evidence is no longer evidence of absence — it may be evidence of sophistication.

MITRE ATT&CK  

• T1078 — Valid Accounts: Dominant technique across every report — 850% detection increase, 23% of cloud compromises via vishing, credential theft at 2x encryption prevalence
• T1190 — Exploit Public-Facing Application: #1 initial access vector with 44% increase — opportunistic scanning by 109+ groups
• T1566.004 — Phishing: Voice Phishing: Surged to 11% overall, 23% of cloud investigations — bypasses all email security controls
• T1189 — Drive-by Compromise: 22-second handoff from browser infection to ransomware deployment via FAKEUPDATES
• T1497 — Virtualization/Sandbox Evasion: Top 5 technique for first time — trigonometric mouse analysis to detect analysis environments
• T1526 — Cloud Service Discovery: Legitimate cloud APIs weaponized for reconnaissance and lateral movement

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.