Defensive Security Trends

Cyber security is changing, and as a senior you must keep up. Whenever L1 escalates an intrusion alert to you, you should already know what threat group or attack vector it matches. Also, since you are now more involved in strategy planning, you should know what to focus on to keep your SOC team effective. This room will help you prepare for both duties by exploring many interesting cyber trends.

Learning Objectives

• Learn how attacks are getting faster and more complex
• Explore how adversaries acquire and use valid accounts
• Discover supply chain attacks from a SOC perspective
• See how AI impacts cyber security and how to keep up

Prerequisites

• Fundamental defensive security knowledge

Attacks Become Faster

I'd like to start from my own experience. In 2025, the Akira ransomware group found a way (opens in new tab) to bypass VPN authentication on SonicWall firewalls and used it to hit a company running that software. In 40 minutes, they went from the VPN bypass to exfiltrating data from a large Active Directory domain and deploying ransomware across it. The SOC team received a few alerts, but failed to react in time to stop the threat before impact. Attacks are getting really fast nowadays!

More Examples

• The DFIR Report shared a case where ransomware was deployed in under 4 hours (Report (opens in new tab))
• Malwarebytes shared a ransomware case happening within 8 hours (Blog post (opens in new tab))
• Huntress reports the average time-to-ransomware was almost 17 hours (Report (opens in new tab))
• CrowdStrike reports the fastest recorded eCrime breakout time was 27 seconds (Report (opens in new tab))
  Note: Breakout time means a pause between the initial access and attack impact

How SOCs Can Prepare

Attacks Are Getting Complex

In addition to getting faster, attacks are becoming more sophisticated. To counter modern security measures, adversaries rapidly change their infrastructure, plan their campaigns to appear like normal business activity, and blend in with routine IT operations and DevOps automation to avoid detection. Below are a few examples of how adversaries hide themselves:

• DarkGate malware was delivered (opens in new tab) via AnyDesk, a commonly used remote access tool
• Shai-Hulud worm used (opens in new tab) a legitimate scanner, Trufflehog, to harvest the victim's secrets
• APT41 implemented (opens in new tab) its Command & Control channel via the Google Calendar API
• Cybercrime services like Fox Tempest (opens in new tab) can digitally sign malware binaries for a price

Attacks Are More Diverse

Modern attacks can originate from anywhere. As a recent example, a developer wanted to test their app against a vulnerability (React2Shell) and downloaded a scanner from GitHub to do it. Unfortunately, the scanner itself was backdoored with an infostealer, and without a SOC reaction, the developer would never have known it. The SOC needs visibility into every possible scenario and detection rules covering a wide range of attack techniques.

Backdoored part of the now-removed React2Shell scanner

In another case, a virus posed as a 10,000-line antimalware script by inserting fake comments, external references, and dummy functions. It worked, and junior analysts with AI tools labeled the virus as legitimate software. Overall, once adversaries see a new trend in defensive security (such as AI-assisted triage) that is too effective against regular attacks, they quickly come up with clever bypasses. A few examples:

• Since EDR solutions are getting more popular, EDR killers (opens in new tab) are developing as well
• Instead of regular attacks, adversaries recruit (opens in new tab) insiders who would sell admin access
• Attackers can even use trusted defensive tools against defenders themselves
  (E.g., attackers installed (opens in new tab) Velociraptor, a legitimate DFIR tool, to control the victims)

The Fading Network Perimeter

Another factor complicating triage is the fading concept of the network perimeter. In the past, a corporate firewall separated "trusted" inside from "malicious" outside, which was simple to understand and monitor. But now, users log in from personal devices, servers run on third-party clouds, and apps rely on hundreds of dependencies outside of your control. Keeping all this under control is a massive challenge for security teams and SOCs. The next tasks will dive deeper into this topic.

Traditional network perimeter on the left
vs modern environments on the right

Valid Accounts

You might have heard the "attackers don't break in, they log in" phrase. Indeed, many breaches start not from a noisy brute force, but from a regular login to a VPN, cloud application, or other Internet-facing service. Such logins can occur during working hours, from an expected country and user-agent, and are generally hard to detect and protect against. But how do attackers gain valid credentials? Meet data stealers!

Valid accounts abuse was observed in 39% of recorded incidents
(Verizon 2026 Data Breach Investigations Report (opens in new tab))

Data Stealers

Data stealers (or infostealers) are big drivers of ransomware attacks and major intrusions, but many people underestimate the risks. An infostealer infection on a single IT admin's laptop a year ago can lead to a sudden ransomware attack now if the stolen credentials weren't changed. Even if the company enforces MFA, infostealers can steal browser sessions, access tokens, SSH keys, and other authentication materials that work without MFA.

Two real-world examples of how AMOS infostealer appears on the workstations (PCrisk (opens in new tab), CloudSEK (opens in new tab))

There are many ways data stealers can appear on laptops, from phishing and pirated software to fake captchas and supply chain attacks. All infostealers work similarly, so top EDR solutions and mature SOC teams should have no problems preventing infostealer attacks. However, to prevent something, you must detect it first - make sure your SOC has visibility into all workstations, and has the appropriate rules matching infostealers' behavior.

Darknet Markets

Many groups around the world operate data-stealing campaigns, and stolen data is almost always packaged into "logs", archives with data from the victims, and sold on dark web marketplaces or Telegram channels. Most "logs" do not contain valuable information, but some may have corporate credentials. The buyers of the logs are typically Initial Access Brokers (IAB), groups dedicated to filtering the "logs" and reselling the valid credentials to ransomware groups.

One of the darknet markets selling the "logs" from Lumma stealer (SOCRadar (opens in new tab))

SOC Tips

Attackers can get valid credentials from many sources, but the tips are the same:

• Allow logins only from corporate devices (e.g., with Entra ID Conditional Access (opens in new tab))
• Develop rules that look for anomalous logins (e.g., logins from known VPN addresses (opens in new tab))
• When in doubt, better disable the user and contact the employee to approve the login

What Is a Supply Chain Attack

A supply chain attack doesn't go after the target directly, but compromises the services or dependencies the target relies on. If you want to compromise thousands of companies at once, attack Microsoft and backdoor a Windows Update. If you can't find a vulnerability in a web application, backdoor one of its many open-source JavaScript dependencies. Supply chain attacks are a big threat to any company, and they are getting very popular among threat groups.

Statistics of Software Supply Chain Attacks (Sonatype (opens in new tab))

Vercel 2026 Incident

Supply chain attacks are hard to detect and respond to. Suddenly, a trusted program would start doing malicious actions, and you won't know why until someone else reports it on GitHub, Twitter, or Reddit. Even worse is when your cloud provider is breached, such as during the Vercel April 2026 incident. The adversaries:

1. Compromised Context.ai by using AWS cloud credentials, stolen with Lumma Stealer
2. Exfiltrated OAuth tokens of Context.ai customers, including Vercel (Context.ai → Vercel chain)
3. Used the Vercel OAuth token to move laterally to internal Vercel systems and databases
4. Exfiltrated secrets of Vercel customers, affecting many companies (Vercel → Customers chain)

Vercel April 2026 supply chain diagram (Trend Micro (opens in new tab))

Tips for SOC Teams

Supply chain attacks are a constant risk for software development companies, and SOC teams need to be ready for them. Although they bypass the perimeter and can start from anywhere in the network, they unfold as any other intrusion and attack techniques, tactics, and procedures (TTPs) remain the same. This is why broad visibility and strong detection coverage are so important. A few supply-chain-specific tips on top of that:

AI for SOC Analysts

AI can greatly automate routine tasks and support analysts with tasks like deobfuscation, enrichment, and report writing. Many SIEM and EDR vendors have already added chatbots to their platforms that can support triage. The simplest start for your team would be to integrate your SIEM with AI service (e.g., google "Splunk and Claude MCP") and ask it to investigate an alert or aggregate statistics. Once it works, you can then tune it according to your needs.

Example of SIEM and Claude integration (Panther (opens in new tab))

Be Careful With the AI Boom!

• Juniors will over-rely on AI verdicts without a proper mentorship
• IT will spin up new infrastructure faster than SOC can onboard it
• Other departments will start using random, insecure AI plugins
• Try to keep things under SOC control and hold people accountable

AI for Adversaries

AI is helpful to adversaries as it can automate most attack actions: drafting trustworthy phishlets, writing malware, scanning for vulnerabilities, and assisting human attacks during their work. As a result, it takes less time to prepare exploits, find vulnerabilities, and redeploy infrastructure. For example, Hoxhunt reports AI-generated phishing emails now surpass human red teams:

Note: "Fail" means an employee opened a phishing email,
created by a human red teamer or AI (Hoxhunt (opens in new tab))

AI-Themed Attacks

AI also became a new attack surface: first by introducing new vulnerabilities, such as prompt injection, and second by becoming a hot topic. Phishing emails, backdoored IDE extensions, and fake browser plugins are now commonly AI-themed. SOC can't stop it on its own, but you are encouraged to push security awareness trainings focused on AI risks, so that employees understand the consequences of their actions.

What AI Doesn't Change

First, AI hasn't changed the fundamental flow of cyber attacks. The Cyber Kill Chain and MITRE ATT&CK remain valid for AI-powered attacks too. Intrusions have become faster, more complex, and more unique from case to case, but they can all be mapped to MITRE techniques. If your SOC is mature with good rule coverage and IT keeps the environment well-hardened, the AI boom doesn't change your job; you just need to adapt the processes.

None of the MITRE techniques above became obsolete due to AI

Second, AI doesn't change the expectations for tools or analysts. On the tools side, SIEM remains the heart of SOC operations, EDR remains the best way to protect endpoints, and IT admins still need to harden the network as before. On the analyst side, you still need to know what AWS is or how Active Directory works, even when AI handles the work for you. AI is a powerful assistant, but L1/L2 analysts remain the final decision makers. Use AI responsibly!

You will receive two URLs: one covering a recent GitHub breach, and the other Verizon's 2026 Data Breach Investigations Report (DBIR). Both illustrate how the threat landscape is shifting, and why your SOC needs to stay sharp on emerging trends. You are encouraged to read full reports in your free time, but for this challenge, we will focus only on some parts. Read the questions, use the reports to answer them, and good luck!

1. GitHub 2026 Breach

On May 18, adversaries accessed ~3,800 internal repositories of GitHub.
The attack was made possible thanks to a multi-layer supply chain attack.
Start from the official announcement and OSINT the details to answer the questions:

2. Verizon DBIR Report

The latest Verizon DBIR report is packed with valuable insights.
To answer the questions, focus on the sections confirming that:

• Adversaries are using adminware and RMM tools (AnyDesk, ScreenConnect) more than ever
• Valid accounts harvested by infostealers and sold by IABs are then used in ransomware attacks