The Evasive Adversary: Why Modern Attacks Are Harder to See and Faster Than Ever

The 2026 CrowdStrike Global Threat Report describes a threat landscape defined by speed, trust abuse, and cross-domain intrusions. The defining shift is not a new class of attack, but a change in how adversaries operate.

Modern attackers are no longer dependent on malware-heavy campaigns that trip traditional defenses. Instead, they move through legitimate identities, trusted systems, SaaS platforms, cloud control planes, and unmanaged infrastructure—often without ever triggering a conventional “security incident.”

These intrusions blend into normal business operations. Authentication logs look legitimate. Admin actions appear authorized. Data access aligns with valid permissions. By the time defenders realize something is wrong, the attacker has already achieved their objective.

These trends collectively define what CrowdStrike calls “the year of the evasive adversary.”

Attackers no longer win by breaking in loudly—they win by abusing trust quietly and moving faster than defenders can reason.

Speed Is the New Weapon

The most consequential change in the modern threat landscape is time compression.

Attackers are no longer patient or persistent in the traditional sense. Once initial access is achieved (often through stolen credentials or social engineering) the clock starts immediately.

In many observed intrusions lateral movement begins within minutes, data exfiltration starts in under five minutes, and ransomware deployment occurs without ever touching a protected endpoint

The report shows that intrusions are now measured in minutes, not days with the average eCrime breakout time dropped to 29 minutes, and the fastest observed breakout took just 27 seconds.

This fundamentally breaks traditional security operations. SOCs designed around:

• Human investigation

• Ticket queues

• Alert escalation chains

• Manual containment decisions

By the time an alert is reviewed, triaged, and escalated, the attacker has often already pivoted, exfiltrated data, or established persistence elsewhere.

In this environment, speed is not an advantage… it is the deciding factor.

Malware Is No Longer Required

One of the most disruptive findings in the report is this:

82% of detections were malware-free.

This reflects a decisive shift away from custom payloads and toward “living off the land” techniques that abuse what already exists in the environment.

Modern intrusions rely on:

• Valid credentials

• Native administrative tools

• Built-in OS utilities

• SaaS APIs

• Legitimate remote management and support software

This approach severely degrades the effectiveness of:

• Signature-based antivirus

• IOC-driven detection

• Hash blocking

• Static allow/deny controls

When attackers use the same tools as administrators, detection can no longer rely on what was executed. It must focus on who executed it, where, when, and in what context.

This problem is compounded by vulnerability exploitation:

• Zero-days are weaponized faster than defenders can patch

• There was a 42% increase in zero-days exploited before public disclosure

The result is a threat model where payloads are optional, exploits are short-lived, and behavioral context is the only reliable signal.

Identity Is the Primary Attack Surface

Identity has become the most valuable control plane in modern environments and the one attackers target most aggressively.

The report shows that valid account abuse was involved in 35% of cloud incidents, making identity the single most common initial access vector.

Attackers exploit identity through:

• Help desk social engineering and password resets

• MFA fatigue and push bombing

• OAuth abuse and token theft

• Conditional Access manipulation

• SaaS session hijacking

Once identity is compromised, attackers rarely need malware. They simply operate within the permissions of the account.

Common post-compromise actions include:

• Accessing SharePoint, OneDrive, and Google Drive

• Reviewing internal documentation and network diagrams

• Modifying security policies and access rules

• Creating mail-forwarding rules to suppress alerts

• Establishing persistence entirely within identity and SaaS layers

This explains why:

• Cloud, SaaS, and edge devices are preferred entry points

• Cloud-conscious intrusions rose 37% overall

• State-nexus activity in cloud environments increased 266%

Identity is no longer just an authentication mechanism, it is the attack surface attackers care about most.

AI Makes Attackers Faster, Not Smarter

The report is explicit: AI does not fundamentally change attack techniques, but it dramatically improves execution speed, scale, and consistency.

Attackers use AI to:

• Generate phishing content at scale

• Translate lures into local languages

• Automate reconnaissance and scripting

• Prototype malware and exploit code

• Accelerate post-exploitation workflows

This disproportionately benefits:

• Mid-tier actors who previously lacked deep technical expertise

• High-volume social engineering campaigns

• Supply-chain and ecosystem-level compromises

The measurable impact is clear:

• 89% increase in attacks by AI-enabled adversaries

More concerning is the emerging trend of attackers targeting AI systems themselves, including:

• Prompt injection attacks

• AI workflow manipulation

• Compromised AI plugins and Model Context Protocol (MCP) servers

• Malicious “AI tools” distributed as lures

As organizations embed AI into development, security, and business workflows, AI becomes part of the attack surface, not just a defensive capability.

Ransomware Is Now Cross-Domain

Ransomware has evolved beyond endpoint encryption. Modern ransomware groups no longer require persistent access to workstations or servers. Instead, they exploit visibility gaps across domains.

Observed techniques include:

• Encrypting data remotely via SMB shares

• Deploying ransomware exclusively on VMware ESXi

• Using unmanaged virtual machines to dump Active Directory databases

• Exfiltrating data solely from SaaS platforms

This allows attackers to:

• Avoid EDR sensors entirely

• Operate from unmanaged or poorly monitored systems

• Minimize detection opportunities while maximizing impact

As a result, ransomware is no longer an endpoint problem. It is an identity, virtualization, SaaS, and cloud visibility problem.

This explains why ransomware groups increasingly avoid monitored endpoints and focus on ESXi, SaaS data, SMB shares, and unmanaged systems.

China-Nexus Actors Focus on Edge Devices

China-aligned threat actors demonstrated a consistent and deliberate focus on network perimeter and edge devices.

Common targets included:

• VPN appliances

• Firewalls

• Gateways

• Internet-facing services

They weaponized newly disclosed vulnerabilities within days, often before organizations could reasonably patch.

Key characteristics of this activity:

• 38% increase in China-nexus intrusion activity

• 67% of exploited vulnerabilities provided immediate system access

Their objectives are typically long-term and strategic:

• Persistent access

• Intelligence collection

• Positioning in telecom, logistics, and finance sectors

Edge devices remain among the least monitored and least patched assets in most enterprises. Attackers understand that these systems often lack:

• EDR coverage

• Centralized logging

• Behavioral monitoring

That makes them ideal footholds for long-term operations.

Defensive Recommendations

Design for Sub-30-Minute Response

Organizations must assume compromise is inevitable and design defenses for speed rather than manual response. Security controls should automatically detect and disrupt high-risk behaviors such as credential abuse, risky OAuth grants, impossible travel, anomalous sessions, and privilege escalation immediately, without waiting for human approval. Human analysis remains important, but it must occur after automated containment has neutralized the threat, not before, as modern attacks move too quickly for traditional, investigation-first security models.

Treat Identity as Tier-0 Infrastructure

Identity must now be treated as Tier-0 infrastructure, equivalent in criticality to Active Directory, because it governs access across cloud, SaaS, and on-prem environments. Organizations must enforce phishing-resistant MFA, closely monitor help desk and self-service identity workflows, continuously audit Conditional Access and policy changes, detect token abuse and session replay, and centrally log and retain all identity decisions to enable rapid detection, investigation, and response.

Eliminate Unmanaged Blind Spots

Attackers consistently exploit gaps where visibility is weakest, making it essential to inventory and continuously monitor edge devices, ESXi hosts, backup and recovery systems, and SaaS administrative and service accounts. Virtualization and supporting infrastructure can no longer be treated as passive plumbing; they must be managed and defended as security-critical assets, with the same monitoring, logging, and response expectations as core identity and endpoint systems.

Shift From Malware Detection to Behavior Detection

Payload-centric detection is no longer sufficient in modern environments, as attackers increasingly avoid malware altogether. Effective detection must focus on behavioral signals, including living-off-the-land activity, abnormal administrative actions, and suspicious cross-domain identity movement. This requires correlating identity, endpoint, cloud, and SaaS telemetry into a single, unified detection fabric capable of identifying malicious intent within otherwise legitimate activity.

Harden SaaS and Cloud as First-Class Targets

SaaS platforms have become a primary data exfiltration vector, as attackers increasingly abuse legitimate access rather than deploying malware. Organizations must continuously monitor mail-forwarding and inbox rules, OAuth grants and third-party application access, and the creation and use of API tokens, while alerting on abnormal data access patterns and restricting integrations by default to reduce the risk of silent, large-scale data theft.

Secure AI Like Production Infrastructure

AI systems must be governed with the same rigor as any other production-critical platform. Organizations need a complete inventory of AI agents, workflows, models, and plugins; centralized logging of AI inputs, outputs, and decision paths for audit and incident response; controls to detect and prevent prompt injection and workflow manipulation; and supply-chain governance that treats AI components, integrations, and dependencies with the same scrutiny as traditional software and third-party code.

Final Thought

The core message of the report is not about AI, ransomware, or zero-days.

It is this:

Attackers no longer need to break in;  they log in, move fast, and disappear into trusted systems.

Organizations that continue to defend perimeters and endpoints in isolation will continue to fall behind. The only viable defense model going forward is cross-domain visibility, automated response, and identity-centric security.