According to Mandiant's latest threat data, the median time between an initial access event and the hand-off to a secondary threat group dropped from more than 8 hours in 2022 to only 22 seconds in 2025.

Check out my latest CSO report for more insights on how attacker dwell time rose, voice phishing topped email phishing, and threat actors increasingly targeted backup and identity systems.

Faster attacks and ‘recovery denial’ ransomware reshape threat landscape
https://www.csoonline.com/article/4148705/faster-attacks-and-recovery-denial-ransomware-reshape-threat-landscape.html

Check out today's Metacurity for the most critical infosec developments you might have missed over the weekend, including

--Russian spies hijack Signal and WhatsApp accounts in campaign targeting officials and journalists,
--Supply chain attack compromised Trivy vulnerability scanner,
--UK Financial Conduct Authority gave Palantir access to sensitive data,
--Hackers stole $23m in Ether from DeFi protocol Resolv Labs,
--Bluenoroff group stole 18.5k purchase records from gift card platform Bitrefill,
--INC claims theft of 500 GB of sensitive data from Namibia Airports Company,
--LA Metro shut down parts of its computer system following security concern,
--Fancy Bear targeted Ukrainian government agency by exploiting Zimbra webmail flaw,
--Hackers reportedly gained access to Crunchyroll ticketing system in supply chain attack,
--Fairfield City Council in Western Sydney hit by ransomware attack,
--Korea's top domestic lending company hit by a cyberattack,
--Cloaked raised $375m in new funding rounds,
--Krypt3ia pulls back the curtain on MuddyWater,
--University of Mississippi Medical Center lost 20% of revenue in cyberattack
https://www.metacurity.com/russian-spies-hijack-signal-and-whatsapp-accounts-in-campaign-targeting-officials-and-journalists/

South Korea continues to take it on the chin.

Personal and credit information was leaked after NRL Capital Lend, a 100% subsidiary of The LEADCORP, the No. 1 domestic lending company in the country, was hit by a hacking attack.
https://biz.chosun.com/en/en-finance/2026/03/22/QN57OMWVMJG6BP6VIBN6IA42XI/