Threat reports love glamour shots: codenames, attribution maps, zero-day counts. Defenders need something more useful, namely what these groups do after they get in, because that is the part you can actually detect.
This report distills the tradecraft patterns behind the most active state-aligned and criminal groups over the past year. We deliberately lead with behavior over attribution. Knowing an intrusion is "probably group X" changes almost nothing about your response; knowing the intrusion pattern is "edge device to service account to hypervisor" changes everything.
The year of the edge device
The single most consistent initial-access story is the network edge: VPN concentrators, mail gateways, file-transfer appliances, and firewalls. These devices sit outside EDR coverage, run opaque firmware, and hold privileged positions by design. Multiple groups have industrialized the pattern, chaining an appliance exploit into credential theft within hours of a CVE publication.
The defensive consequence is architectural rather than procedural. Appliance telemetry must be fused with identity and network signals, because the compromise only becomes visible at the seams: an appliance service account authenticating somewhere new, or an appliance suddenly speaking protocols it never used before.
Identity is the new persistence
Sophisticated groups increasingly skip malware entirely. Stolen session tokens, malicious OAuth grants, federated trust abuse, and MFA fatigue attacks give them persistence that survives reimaging, because the persistence lives in your identity provider instead of on any host.
- Token theft over credential theft: a stolen session cookie sidesteps MFA entirely and looks like the user it was taken from.
- OAuth as a backdoor: a consented application with mail-read scope is persistence nobody reimages away.
- Trust-chain abuse: compromise one federation or sync service and inherit every downstream trust.
- Help-desk social engineering: reset flows are the soft underbelly of otherwise hardened identity stacks.
Reimaging the laptop does nothing when the persistence lives in the identity provider.
Living off the land, at scale
Post-compromise tradecraft has converged across state and criminal actors: native tools, remote-management software, and legitimate cloud services. PsExec, wmic, PowerShell, and commercial RMM agents move laterally; file-sharing services carry data out. Individually, every one of these events is unremarkable. The signal only exists in combination.
This is precisely why signature-only programs feel blind. There is no hash to match when the attacker's toolkit is your toolkit. Detection has to come from behavioral baselines: this account has never used this tool, this host has never spoken to that subnet, this volume is wrong for this hour.
Sector patterns worth knowing
| Sector | Dominant pattern | First signal to watch |
|---|---|---|
| Healthcare | Ransomware via exposed remote access | New RMM tools and off-hours admin logons |
| Manufacturing | IP theft through cloud sync abuse | Bulk downloads to unmanaged devices |
| Finance | Token theft and consent phishing | Impossible travel on refresh tokens, new OAuth grants |
| Public sector | Edge appliance exploitation | Appliance accounts authenticating to new targets |
| Technology | Supply-chain and build-system access | CI service accounts acting interactively |
What defenders should take from this
The groups change names; the physics of intrusion do not. Everything above lands on the same three defensive investments: fuse your signals so cross-domain patterns are visible, baseline normal behavior per identity and asset, and make investigation cheap enough that no anomaly is left unexplained because everyone was busy.
See Port0 on your own data.
Bring your noisiest alert queue. Watch Soc0 investigate it live.
