Hackers Increasingly Prefer Fast and Low-Complexity Attacks

There’s no need to invest into sophisticated hacking operations when moving fast and exploiting well-trod techniques gives threat actors all the access they want.

See Also: AI Arms Cybercriminals, and Defenders Must Match Pace

Across a range of different types of attacks, “threat actors are increasingly prioritizing accessible and low-complexity entry points, rather than investing in sophisticated exploits,” says a new report from cybersecurity firm Arctic Wolf.

Unsurprisingly, phishing is a regular standby. The vast majority of business email compromise attacks started with an infection from a phishing email, a figure that probably will only climb upward as artificial intelligence makes “fraudulent messages more convincing and scalable.”

Attackers also increasingly prefer to remotely log into systems whenever possible (see: ‘Crazy’ Hackers Strike Through Remote Monitoring Software).

The majority of ransomware attacks start with hackers gaining access to a victim’s network by abusing remote access services, including remote desktop protocol, virtual private network and remote monitoring and management tools, Arctic Wolf said.

Attackers’ definition of “remote access” is expanding beyond just using VPNs or RDP. Some groups are increasingly using voice phishing – often, telephoning IT help desk staff – or email phishing, in an attempt to target “SaaS administrative access, OAuth tokens, API integrations and delegated trust relationships,” said ransomware incident response group Coveware in a report (see: Voice Phishing Okta Customers: ShinyHunters Claims Credit).

“Attackers are not breaking controls so much as operating within them: logging in, being provisioned or inheriting access through workflows designed for legitimate use,” it said.

A rising number of attacks belie not signs of careful, lengthy reconnaissance, but rather smash-and-grab tactics. “Exploitation today is less about persistence and more about speed to impact,” Coveware said.

Many ransomware attacks last year were notable for sheer speed. The Akira ransomware group in particular often moved extremely quickly, in one case progressing from breach to encryption in 180 minutes, and in another from breach to data exfiltration in just 60 minutes, says Barracuda Networks in a report based on 600,000 security alerts collected last year by its managed XDR – for extended visibility, detection and response – service.

Watch for TTPs

Many attacks employ consistently used tactics, techniques and procedures, referring to the high-level behavior and highly detailed steps a threat actor employs to execute an attack. Monitoring for such TTPs can obviously help tip off defenders to when an attack might be unfolding.

Barracuda reported that for 90% of the ransomware incidents tracked by its managed XDR service, attackers attempted to exploit an organization’s edge devices – typically, a firewall – by using a known vulnerability or else logging in using stolen or brute-forced account credentials.

Many suspicious privilege escalations were spotted by detecting a new user being added to a group with high-risk security rights. Seeing a user removed can also be an indicator, since such activity can reveal when an attacker gained elevated access, deployed malware and then removed their permissions, to try and hide their tracks. Look for alerts of a user being added or removed as a Microsoft 365 global administrator or firewall administrator.

Incident responders continue to urge system administrators to ensure that basic but high-impact defenses are in place. Robust vulnerability management, strengthening access controls and better logging and monitoring are essential. So too is minimizing an organization’s internet exposure by decommissioning unused equipment, turning off all unnecessary services and features (see: Telnet Flaw: 800,000 Servers at Risk Amid Active Attacks).

Arctic Wolf said that for the cases it investigated besides business email compromise, hackers most often used vulnerabilities that became public knowledge last year or the year before. “Patching even just the most-exploited vulnerabilities can significantly improve an organization’s security posture,” it said. It also advised organizations to always “rotate credentials following any known vulnerability exposure, otherwise cybercriminals can simply return later and log in using stolen credentials,” as multiple attacks continue to demonstrate (see: Fortinet Locks Down FortiCloud SSO Amid Zero-Day Attacks).

“Most compromises succeeded not because systems were unpatched, but because configuration debt persisted: stale credentials, legacy local accounts after migrations, and insufficient visibility into cloud identity and token usage,” Coveware said.

Incident responders said one major takeaway from 2025 attacks is the extent to which TTPs haven’t changed.

“Finding vulnerabilities, crafting exploits and weaponizing them at production scale is time-consuming, expert-driven and expensive work. That means it’s much cheaper to stick with tried-and-true TTPs. Only when these offer scarce returns will a group be motivated to build or buy some hot new exploit or develop a new attack chain,” Arctic Wolf said.

There was one notable development in 2025, and that was campaigns designed to subvert tools widely used by IT personnel and developers, including in the form of npm packages, to try and gain access to corporate networks or subvert code bases for supply-chain attacks. Other rising tactics included an increased focus on search engine optimization poisoning to target the same types of users (see: Automated Shai Hulud Infects Thousands of NPM Repositories).