Modern enterprise networks are widely distributed and can hand off tasks to partners via software-as-a-service. The bad guys are doing the same thing, according to Mandiant, using a "division of labor" model: one group uses low-impact techniques like malicious advertisements or fake browser updates to gain access to a network, then hands off the compromised target to a secondary group for hands-on access.

And this all happens at a startling pace. In 2022, Mandiant reports, this "time to hand off" was more than eight hours. In 2025, thanks to automation, those hand-offs were happening after an average of just 22 seconds. Likewise, the window to compromise systems with zero-day exploits is also plummeting, with the mean time to exploit vulnerabilities dropping to seven days before vendors have had time to issue a patch.

According to Mandiant, the majority of attackers conducting "hands-on-keyboard operations" in compromised enterprise networks can be divided into two groups with distinctly different tactics and pacing: Cybercriminals pursue financial gain, using tools like ransomware, while espionage groups optimize for long-term, stealthy access.

On one end of the spectrum, cyber criminal groups optimized for immediate impact and deliberate recovery denial. On the other end, sophisticated cyber espionage groups and insider threats optimized for extreme persistence, utilizing unmonitored edge devices and native network functionalities to evade detection.