Criminals Don't Want Elegant Attacks — They Want Repeatable Ones

The most common way to break into a company last year was simply to ask. A web page invites the visitor to prove they aren't a robot, and while they're reading the instructions it quietly copies a command to the clipboard and coaxes them into pasting it into a terminal. The technique is called ClickFix, and according to Microsoft it accounted for 47% of initial intrusions. There's no attachment — nothing to scan. There's no vulnerability — nothing to patch.

What comes next is just as mundane. Bitdefender's analysis of 700,000 incidents showed that in 84% of high-severity cases the attackers used binaries already present on the machine — the very administrative utilities IT staff rely on every day. Nothing malicious was installed, because nothing needed to be.

This is a business, and businesses standardize

A group that has to invent something new for every victim doesn't scale. A group with a ready-made procedure grows as fast as it can find targets. Hence the rise of vulnerability exploitation: according to the Verizon DBIR, it moved into first place among initial-access vectors — 31%, up from 20% a year earlier.

The procedure for edge devices is short enough to fit on an index card: watch for new CVEs in internet-facing devices; pick out the ones that allow remote code execution without authentication; wait for someone to publish a working PoC on GitHub (usually within days); then scan the internet and take everything that hasn't been patched in time. No one in this chain develops anything. The author compares it to a generics manufacturer: it doesn't discover the drug, it waits for someone else's research to become public and then stamps out the known formula. The patent expires the day the PoC lands on GitHub.

You can see it in the leaders, too. For more than a year the top of the ransomware rankings was held by Qilin (about 1,600 victims, over a hundred a month), until in June it was displaced by The Gentlemen — 121 victims to 80. The most telling thing is the newcomer's origin: it split off from a former Qilin affiliate. The ready-made playbook simply changed hands and worked just as well.

The economics point the same way

More victims, less money: ransomware's share rose to 48% of breaches, but 69% of those hit didn't pay, and the median ransom fell from $150,000 to $139,875. Falling revenue per attempt doesn't push you to make each attempt more sophisticated — it pushes you to make it cheaper and run it more often.

Here, too, is the argument against autonomous AI. A playbook costs almost nothing, while a model in the loop adds real cost to every attempt — and not where you need it. An autonomous agent improvises and behaves differently in every environment, whereas the whole point of a ransomware franchise is the same result in unfamiliar hands. A different role for AI is rational: an offline assistant for preparing the playbook, not an operator standing over every victim.

What actually helps

A standard attack is a standard problem for the defense. Patch intelligently, hitting the window between a vulnerability's disclosure and the appearance of an exploit. Restrict what can run at all, and who can invoke built-in utilities. Treat identity, not the network, as the perimeter. Look at events in combination, not in isolation. And finally, keep watch: in its investigations Bitdefender again and again finds either no endpoint protection at all or a system no one is monitoring. A detection no one reads isn't a detection — it's a log to be read after the fact.

Attackers don't want a Lamborghini, they want a Toyota: it starts every morning, anyone can drive it, it can be fixed anywhere. That's exactly what ClickFix is, and so is “living off the land.”

Source: The Hacker News