27 Seconds from Breach to Lateral Movement

27 seconds. That’s exactly how long it took the fastest attacker in 2025 to move from initial compromise to lateral movement within a network. Not 27 minutes. 27 seconds. CrowdStrike has just released its annual Threat Report, and I’m going to walk you through what changed in 2025. Trust me, some of these numbers will surprise you.

CrowdStrike tracks over 281 hacking groups worldwide and processes trillions of security events daily.

The average breakout time — the window between initial compromise and lateral movement — dropped to 29 minutes. In 2021, it was still 98 minutes. In one case, it was just 27 seconds.

82 percent of all detections in 2025 were completely malware-free. No virus, no trojan. Attackers operate through legitimate accounts, trusted identities, and approved SaaS tools. They simply look like your employees.

The group CHATTY SPIDER, for instance, targeted American law firms. They called the front desk, convinced an employee to grant remote access via Microsoft Quick Assist, and within four minutes were already exfiltrating data. The entire attack took less than an hour.

The number of attacks leveraging artificial intelligence grew by 89 percent year over year. And it’s not just about generating phishing emails.

North Korean group FAMOUS CHOLLIMA uses ChatGPT and GitHub Copilot to maintain fraudulent employment at Western companies. Russian group FANCY BEAR deployed malware that communicates directly with a language model via the Hugging Face API, having it generate reconnaissance commands.

But here’s the twist — AI systems themselves are becoming targets. Attackers exploited a vulnerability in the Langflow platform and deployed ransomware through it. A fake MCP server was discovered redirecting emails. And in August 2025, attackers uploaded malicious packages to npm that abused local AI tools.

China-linked activity surged by 38 percent. The primary targets? Network perimeter devices — VPNs, firewalls, gateways. In 40 percent of cases, attackers specifically targeted edge devices, and two-thirds of exploited vulnerabilities allowed immediate remote code execution. The group WARP PANDA maintained access through a compromised VPN for a full 22 months in one case.

And what about supply chain attacks? North Korean group PRESSURE CHOLLIMA pulled off the largest cryptocurrency theft in history. They compromised a single developer at Safe Wallet, injected a few lines of JavaScript, and redirected transactions from the Bybit crypto exchange worth $1.46 billion. Then they cleaned up after themselves.

Cloud intrusions rose by 37 percent. For state-sponsored actors, the increase was 266 percent. Abuse of legitimate accounts accounted for a third of all cloud incidents.

Russian group COZY BEAR combines impersonation of trusted contacts with legitimate Microsoft authentication pages. Victims enter their credentials exclusively on genuine Microsoft sites. No suspicious domain, no warning sign.

What’s the takeaway? Traditional perimeter defense is no longer enough. Attackers operate through trusted pathways, leverage AI, and move where you can’t see them — in the cloud, in identities, in the supply chain.

Priority number one? Patch edge devices within 72 hours. Deploy phishing-resistant MFA. And most importantly, test your defenses before a real attacker does.

Do you know if your systems are secure?

Every week, we bring examples of attacks and vulnerabilities that can affect anyone. If you’re not sure whether your infrastructure is resilient, we’re happy to help you find out. At SysNetShield, we offer vulnerability scanning, penetration testing, Red Teaming, and phishing campaign simulations.

Write to us at team@sysnetshield.com — the first consultation is free.

ShinyHunters Extort Cisco

On March 31, 2026, the hacking group ShinyHunters published an extortion post threatening Cisco with the release of more than three million sensitive records unless the company met their demands by April 3. The deadline has now passed without any public statement from Cisco.

The theft is linked to the compromise of the security scanner Trivy by the group TeamPCP, which we covered in detail in the previous Security Sunday.

The attackers claim they gained access to three distinct data sources. The first is Salesforce CRM records, the second is data from the Salesforce Aura platform (Experience Cloud), and the third is the contents of AWS S3 buckets. Part of the access was reportedly obtained through voice phishing (vishing), referred to in their terminology as operation UNC6040. The total number of records exceeds three million and includes personally identifiable information, internal configuration data, and credentials for additional systems.

Particularly alarming is the nature of the exposed data. According to ShinyHunters, the stolen records include information tied to FBI and NASA employees.

These records are most likely a consequence of the fact that these institutions are Cisco customers, and their contact or contractual data was stored in Cisco’s Salesforce environment. Along with the database records, the attackers claim to have exfiltrated more than 300 private GitHub repositories, including source code related to AI projects and enterprise clients.

The technical trail leads back to the Trivy compromise on March 19, 2026. The TeamPCP group injected an infostealer into the GitHub Actions pipeline, stealing cloud credentials from thousands of teams that ran a Trivy scan that day.

North Korea Compromised Axios

On the same day ShinyHunters began extorting Cisco, another incident was recorded.

Attackers compromised the npm account of the lead maintainer of Axios, a JavaScript HTTP library with approximately one hundred million weekly downloads, and within 39 minutes published two backdoored versions — 0.30.4 and 1.14.1.

The malicious versions introduced a single new dependency called plain-crypto-js, an entirely unknown package created exclusively for this attack. Its postinstall hook runs automatically on every npm install without any user interaction, silently downloading and executing a specific implant to establish remote access.

The malicious versions were available on npm for approximately two to three hours before Elastic Security Labs detected them and npm pulled them down. Despite the short exposure window, the potential impact is enormous. Axios is one of the most critical dependencies in the entire JavaScript ecosystem and is used in tens of millions of projects.

Microsoft Threat Intelligence attributed this attack to Sapphire Sleet, a North Korean state-sponsored actor. Google tracks the group under the designation UNC1069, a financially motivated North Korean actor active since at least 2018, specializing in credential theft and cryptocurrency theft.

Chinese Hacking Group TA416 Returns to Europe

European governments and diplomatic institutions have been facing a wave of cyberattacks from the Chinese hacking group known as TA416 since mid-2025. After a two-year period of relative quiet, during which the group focused primarily on Southeast Asia and Mongolia, its attention has shifted back to Europe.

According to researchers at Proofpoint, who published their findings in early April, the campaigns targeted diplomatic missions at the European Union and NATO across multiple European countries. The group’s renewed interest in Europe coincides with rising tensions between the EU and China over trade, rare earth exports, and differing stances on the Russia-Ukraine conflict.

TA416, also known as RedDelta, Vertigo Panda, DarkPeony, or SmugX, is one of the most active Chinese cyber-espionage groups. Its activities partially overlap with another notorious group, Mustang Panda, and the two share some techniques and tools. TA416’s primary weapon is a custom variant of the PlugX malware — a sophisticated backdoor that enables attackers to steal system information, execute remote commands, download additional malicious software, or uninstall itself from the system.

According to new research from Darktrace, Chinese cyber operations have undergone a significant transformation in recent years — evolving from isolated intrusions into long-term strategic operations aimed at gaining persistent access to critical infrastructure networks. In one documented case, attackers fully compromised an environment and established persistent access, only to return after more than 600 days of inactivity. American organizations accounted for more than one-fifth of all globally recorded incidents linked to Chinese actors according to Darktrace, followed by Italy, Spain, Germany, and others. The majority of cases involved the exploitation of publicly accessible infrastructure as the initial entry point.