# Defensive Security Trends (TryHackMe)

Link to the challenge on TryHackMe: [Defensive Security Trends](https://tryhackme.com/room/defensivesecuritytrends)

## Introduction

Cyber security is changing, and as a senior you must keep up. Whenever L1 escalates an intrusion alert to you, you should already know what threat group or attack vector it matches. Also, since you are now more involved in strategy planning, you should know what to focus on to keep your SOC team effective. This room will help you prepare for both duties by exploring many interesting cyber trends.

## **Learning Objectives**

*   Learn how attacks are getting faster and more complex
    
*   Explore how adversaries acquire and use valid accounts
    
*   Discover supply chain attacks from a SOC perspective
    
*   See how AI impacts cyber security and how to keep up
    

## **Prerequisites**

*   Fundamental defensive security knowledge
    

## Attacks Become Faster

## **Attacks Become Faster**

I'd like to start from my own experience. In 2025, the Akira ransomware group [found a way(opens in new tab)](https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/) to bypass VPN authentication on SonicWall firewalls and used it to hit a company running that software. In **40 minutes**, they went from the VPN bypass to exfiltrating data from a large Active Directory domain and deploying ransomware across it. The SOC team received a few alerts, but failed to react in time to stop the threat before impact. Attacks are getting really fast nowadays!

![Timeline showing SOC response lag: attacker VPN login at 0 min, SIEM alert at +10 min, ransomware deployed at +40 min, SOC response begins at +50 min.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1779239306382.svg align="center")

**More Examples**

*   The DFIR Report shared a case where ransomware was deployed in under 4 hours ([Report(opens in new tab)](https://thedfirreport.com/2022/04/25/quantum-ransomware/))
    
*   Malwarebytes shared a ransomware case happening within 8 hours ([Blog post(opens in new tab)](https://www.threatdown.com/blog/from-weeks-to-hours-why-ransomware-attacks-are-getting-quicker/))
    
*   Huntress reports the average time-to-ransomware was almost 17 hours ([Report(opens in new tab)](https://www.huntress.com/blog/for-ransomware-time-to-ransom-is-money))
    
*   CrowdStrike reports the fastest recorded eCrime breakout time was 27 seconds ([Report(opens in new tab)](https://www.crowdstrike.com/en-us/global-threat-report/))  
    **Note**: Breakout time means a pause between the initial access and attack impact
    

## **How SOCs Can Prepare**

| **#** | **Recommendation** | **Description** |
| --- | --- | --- |
| 1 | Contain first, investigate second | Use EDR capabilities and SOAR playbooks to contain the threats before a human analyst joins, and then use your log analysis skills to dig deeper, finalize the response, and tune the tools if needed. |
| 2 | Address detected security gaps | Always report detected vulnerabilities and misconfigurations to your IT team and control the fixes. The better your network is configured, the longer attacks will take, and the more time you'll have to stop them. |
| 3 | Automate time-consuming routine | Think about which part of your triage takes the most time and optimize or automate it. It may be a slow SIEM, a lack of context, or just a ticketing routine. Your goal is to begin a response as soon as possible. |

### Answer the questions below

Refer to the mentioned Huntress report.  
What is the reported average time-to-ransomware? `17 hours`

What should SOCs do with triage routine to speed up response?  
Answer Example: Ignore it `Automate it`

## Attacks Become Complex

## **Attacks Are Getting Complex**

In addition to getting faster, attacks are becoming more sophisticated. To counter modern security measures, adversaries rapidly change their infrastructure, plan their campaigns to appear like normal business activity, and blend in with routine IT operations and DevOps automation to avoid detection. Below are a few examples of how adversaries hide themselves:

*   DarkGate malware was [delivered(opens in new tab)](https://thehackernews.com/2024/12/attackers-exploit-microsoft-teams-and.html) via AnyDesk, a commonly used remote access tool
    
*   Shai-Hulud worm [used(opens in new tab)](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/#:~:text=supply%20chain%20hardening.-,Analyzing%20the%20Shai%2DHulud%202.0%20attack) a legitimate scanner, Trufflehog, to harvest the victim's secrets
    
*   APT41 [implemented(opens in new tab)](https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics) its Command & Control channel via the Google Calendar API
    
*   Cybercrime services like [Fox Tempest(opens in new tab)](https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/) can digitally sign malware binaries for a price
    

## **Attacks Are More Diverse**

Modern attacks can originate from anywhere. As a recent example, a developer wanted to test their app against a vulnerability (React2Shell) and downloaded a scanner from GitHub to do it. Unfortunately, the scanner itself was backdoored with an infostealer, and without a SOC reaction, the developer would never have known it. The SOC needs visibility into every possible scenario and detection rules covering a wide range of attack techniques.

![Wayback Machine archive of GitHub repo showing backdoored react2shell.Wayback Machine archive of GitHub repo showing backdoored react2shell.py.py code with hidden subprocess execution.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1779222549475.png align="center")

*Backdoored part of the now-removed React2Shell scanner*

In another case, a virus posed as a 10,000-line antimalware script by inserting fake comments, external references, and dummy functions. It worked, and junior analysts with AI tools labeled the virus as legitimate software. Overall, once adversaries see a new trend in defensive security (such as AI-assisted triage) that is too effective against regular attacks, they quickly come up with clever bypasses. A few examples:

*   Since EDR solutions are getting more popular, [EDR killers(opens in new tab)](https://thehackernews.com/2026/03/54-edr-killers-use-byovd-to-exploit-34.html) are developing as well
    
*   Instead of regular attacks, adversaries [recruit(opens in new tab)](https://cybersecuritynews.com/threat-actors-are-hiring-insiders-in-banks-telecoms/) insiders who would sell admin access
    
*   Attackers can even use trusted defensive tools against defenders themselves  
    (E.g., attackers [installed(opens in new tab)](https://www.huntress.com/blog/velociraptor-misuse-part-one-wsus-up) Velociraptor, a legitimate DFIR tool, to control the victims)
    

## **The Fading Network Perimeter**

Another factor complicating triage is the fading concept of the network perimeter. In the past, a corporate firewall separated "trusted" inside from "malicious" outside, which was simple to understand and monitor. But now, users log in from personal devices, servers run on third-party clouds, and apps rely on hundreds of dependencies outside of your control. Keeping all this under control is a massive challenge for security teams and SOCs. The next tasks will dive deeper into this topic.

![A side-by-side diagram. Left: firewall blocks adversary from single trusted network. Right: adversary reaches cloud, SaaS, on-prem, and remote workers directly, no single perimeter to defend.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1780485050511.svg align="center")

*Traditional network perimeter on the left*  
*vs modern environments on the right*

### Answer the questions below

Which of the mentioned remote access tools was used by DarkGate malware? `AnyDesk`

Is the network perimeter becoming more predictable in modern environments? (Yea/Nay) `Nay`

## Attacks via Valid Accounts

## **Valid Accounts**

You might have heard the "**attackers don't break in, they log in**" phrase. Indeed, many breaches start not from a noisy brute force, but from a regular login to a VPN, cloud application, or other Internet-facing service. Such logins can occur during working hours, from an expected country and user-agent, and are generally hard to detect and protect against. But how do attackers gain valid credentials? Meet data stealers!

![Heatmap of MITRE ATT&CK identity techniques across Groups, Incidents, and Red team engagements; valid accounts (T1078) hit 39% of incidents per Verizon 2026 DB…Heatmap of MITRE ATT&CK identity techniques across Groups, Incidents, and Red team engagements; valid accounts (T1078) hit 39% of incidents per Verizon 2026 DBIR.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1780399412340.png align="center")

*Valid accounts abuse was observed in 39% of recorded incidents*  
*(Verizon 2026 Data Breach Investigations* [*Report(opens in new tab)*](https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf)*)*

## **Data Stealers**

Data stealers (or infostealers) are big drivers of ransomware attacks and major intrusions, but many people underestimate the risks. An infostealer infection on a single IT admin's laptop a year ago can lead to a sudden ransomware attack now if the stolen credentials weren't changed. Even if the company enforces MFA, infostealers can steal browser sessions, access tokens, SSH keys, and other authentication materials that work without MFA.

![Two AMOS infostealer lures: fake Notion download page (notion-apps[.]net) on left, fake Cloudflare CAPTCHA on panel-spectrum[.]net tricking users into running a PowerShell payload on right.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1780485478161.png align="center")

*Two real-world examples of how AMOS infostealer appears on the workstations (*[*PCrisk(opens in new tab)*](https://www.pcrisk.com/removal-guides/26590-atomic-stealer-mac)*,* [*CloudSEK(opens in new tab)*](https://www.cloudsek.com/blog/amos-variant-distributed-via-clickfix-in-spectrum-themed-dynamic-delivery-campaign-by-russian-speaking-hackers)*)*

There are many ways data stealers can appear on laptops, from phishing and pirated software to fake captchas and supply chain attacks. All infostealers work similarly, so top EDR solutions and mature SOC teams should have no problems preventing infostealer attacks. However, to prevent something, you must detect it first - make sure your SOC has visibility into all workstations, and has the appropriate rules matching infostealers' behavior.

## **Darknet Markets**

Many groups around the world operate data-stealing campaigns, and stolen data is almost always packaged into "logs", archives with data from the victims, and sold on dark web marketplaces or Telegram channels. Most "logs" do not contain valuable information, but some may have corporate credentials. The buyers of the logs are typically Initial Access Brokers (**IAB**), groups dedicated to filtering the "logs" and reselling the valid credentials to ransomware groups.

![Screenshot of russian market darknet marketplace listing Lumma stealer logs for $10 each, with filters by stealer, country, and ISP (via SOCRadar).](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1780489337961.png align="center")

*One of the darknet markets selling the "logs" from Lumma stealer (*[*SOCRadar(opens in new tab)*](https://socradar.io/blog/stealer-logs-everything-you-need-to-know)*)*

## **SOC Tips**

Attackers can get valid credentials from many sources, but the tips are the same:

*   Allow logins only from corporate devices (e.g., with [Entra ID Conditional Access(opens in new tab)](https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policy-common?tabs=protect-administrator))
    
*   Develop rules that look for anomalous logins (e.g., logins from [known VPN addresses(opens in new tab)](https://spur.us/context/185.98.171.238))
    
*   When in doubt, better disable the user and contact the employee to approve the login
    

### Answer the questions below

Refer to the screenshot of the Verizon 2026 report.  
What percentage of incidents contained Valid accounts? `39%`

How do you call cyber criminals who sell access to organizations' networks? `Initial Access Brokers`

## Supply Chain Attacks

## **What Is a Supply Chain Attack**

A supply chain attack doesn't go after the target directly, but compromises the services or dependencies the target relies on. If you want to compromise thousands of companies at once, attack Microsoft and backdoor a Windows Update. If you can't find a vulnerability in a web application, backdoor one of its many open-source JavaScript dependencies. Supply chain attacks are a big threat to any company, and they are getting very popular among threat groups.

![A chart showing malicious packages discovered, climbing from near zero in 2019 to 700,000+ by 2024.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1779303256446.png align="center")

*Statistics of Software Supply Chain Attacks (*[*Sonatype(opens in new tab)*](https://www.sonatype.com/state-of-the-software-supply-chain/2024/10-year-look)*)*

## **Vercel 2026 Incident**

Supply chain attacks are hard to detect and respond to. Suddenly, a trusted program would start doing malicious actions, and you won't know why until someone else reports it on GitHub, Twitter, or Reddit. Even worse is when your cloud provider is breached, such as during the Vercel April 2026 incident. The adversaries:

1.  Compromised [Context.ai](http://Context.ai) by using AWS cloud credentials, stolen with Lumma Stealer
    
2.  Exfiltrated OAuth tokens of [Context.ai](http://Context.ai) customers, including Vercel ([Context.ai](http://Context.ai) → Vercel chain)
    
3.  Used the Vercel OAuth token to move laterally to internal Vercel systems and databases
    
4.  Exfiltrated secrets of Vercel customers, affecting many companies (Vercel → Customers chain)
    

![Vercel supply chain attack flow: Context.ai OAuth compromise → Vercel employee Google Workspace takeover → lateral movement → env var enumeration → credential fan-out to hundreds of customers.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1779289177159.jpg align="center")

*Vercel April 2026 supply chain diagram (*[*Trend Micro(opens in new tab)*](https://www.trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html)*)*

## **Tips for SOC Teams**

Supply chain attacks are a constant risk for software development companies, and SOC teams need to be ready for them. Although they bypass the perimeter and can start from anywhere in the network, they unfold as any other intrusion and attack techniques, tactics, and procedures (TTPs) remain the same. This is why broad visibility and strong detection coverage are so important. A few supply-chain-specific tips on top of that:

| **Supply Chain Incident** | **Detection Tips** | **Response Tips** |
| --- | --- | --- |
| [Vercel, 2026(opens in new tab)](https://www.trendmicro.com/en_us/research/26/d/vercel-breach-oauth-supply-chain.html)  
(PaaS for web apps) | Monitor for supply chain threats in cyber news and hunt for traces of infection in your organization once the details are public. | Ensure the least privilege principle. Even if the attackers get the keys, they shouldn't be able to open every door in your network. |
| [Axios, 2026(opens in new tab)](https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html)  
(JavaScript library) | Never discard the alerts just because the process chain starts from a trusted application. First, check for indicators of a supply chain attack. | Wait 3+ days before updating dependencies. Most malicious packages are revoked within hours once the community catches them. |
| [DAEMON Tools, 2026(opens in new tab)](https://thehackernews.com/2026/05/daemon-tools-supply-chain-attack.html)  
(Imaging Software) | No matter if the threat comes from a browser or DAEMON Tools, the next attack steps are usually the same. Ensure your SOC has a good MITRE coverage. | Install EDR and implement application control that blocks software not needed for work. |

### Answer the questions below

Refer to the explained Vercel supply chain incident.  
What malware was the first link in the attack chain? `Lumma Stealer`

Imagine a supply chain attack hits your organization.  
Would attack TTPs fundamentally differ from other intrusions? (Yea/Nay) `Nay`

## AI Impact on Cyber Security

## **AI for SOC Analysts**

AI can greatly automate routine tasks and support analysts with tasks like deobfuscation, enrichment, and report writing. Many SIEM and EDR vendors have already added chatbots to their platforms that can support triage. The simplest start for your team would be to integrate your SIEM with AI service (e.g., google "Splunk and Claude MCP") and ask it to investigate an alert or aggregate statistics. Once it works, you can then tune it according to your needs.

![Claude interface showing a prompt to aggregate SIEM statistics and the AI response from the MCP tool.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1780485691093.png align="center")

*Example of SIEM and Claude integration (*[*Panther(opens in new tab)*](https://panther.com/blog/how-model-context-protocol-helps-security-teams-scale-secops)*)*

**Be Careful With the AI Boom!**

*   Juniors will over-rely on AI verdicts without a proper mentorship
    
*   IT will spin up new infrastructure faster than SOC can onboard it
    
*   Other departments will start using random, insecure AI plugins
    
*   Try to keep things under SOC control and hold people accountable
    

## **AI for Adversaries**

AI is helpful to adversaries as it can automate most attack actions: drafting trustworthy phishlets, writing malware, scanning for vulnerabilities, and assisting human attacks during their work. As a result, it takes less time to prepare exploits, find vulnerabilities, and redeploy infrastructure. For example, Hoxhunt reports AI-generated phishing emails now surpass human red teams:

![Hoxhunt chart comparing phishing fail rates: AI-crafted lures (2.78% overall) outperform human red teamers (2.25%) by 23%, with the gap narrowing as employee training tenure grows.](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1779704714311.png align="center")

*Note: "Fail" means an employee opened a phishing email,  
created by a human red teamer or AI (*[*Hoxhunt(opens in new tab)*](https://hoxhunt.com/blog/ai-powered-phishing-vs-humans)*)*

**AI-Themed Attacks**

AI also became a new attack surface: first by introducing new vulnerabilities, such as prompt injection, and second by becoming a hot topic. Phishing emails, backdoored IDE extensions, and fake browser plugins are now commonly AI-themed. SOC can't stop it on its own, but you are encouraged to push security awareness trainings focused on AI risks, so that employees understand the consequences of their actions.

## **What AI Doesn't Change**

**First**, AI hasn't changed the fundamental flow of cyber attacks. The Cyber Kill Chain and MITRE ATT&CK remain valid for AI-powered attacks too. Intrusions have become faster, more complex, and more unique from case to case, but they can all be mapped to MITRE techniques. If your SOC is mature with good rule coverage and IT keeps the environment well-hardened, the AI boom doesn't change your job; you just need to adapt the processes.

![MITRE ATT&CK Enterprise matrix for Windows showing tactics columns (Initial Access, Execution, Persistence, etc.).](https://cdn-images.tryhackme.com/user-uploads/678ecc92c80aa206339f0f23/room-content/678ecc92c80aa206339f0f23-1779313455264.png align="center")

*None of the MITRE techniques above became obsolete due to AI*

**Second**, AI doesn't change the expectations for tools or analysts. On the tools side, SIEM remains the heart of SOC operations, EDR remains the best way to protect endpoints, and IT admins still need to harden the network as before. On the analyst side, you still need to know what AWS is or how Active Directory works, even when AI handles the work for you. AI is a powerful assistant, but L1/L2 analysts remain the final decision makers. Use AI responsibly!

### Answer the questions below

Should AI become a final decision maker in a SOC? (Yea/Nay) `Nay`

Which MITRE technique became obsolete due to AI? `None`

## Research Challenge

You will receive two URLs: one covering a recent GitHub breach, and the other Verizon's 2026 Data Breach Investigations Report (DBIR). Both illustrate how the threat landscape is shifting, and why your SOC needs to stay sharp on emerging trends. You are encouraged to read full reports in your free time, but for this challenge, we will focus only on some parts. Read the questions, use the reports to answer them, and good luck!

1.  GitHub 2026 Breach On May 18, adversaries accessed ~3,800 internal repositories of GitHub. The attack was made possible thanks to a multi-layer supply chain attack. Start from the official announcement and OSINT the details to answer the questions:
    

https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/(opens in new tab) 2. Verizon DBIR Report The latest Verizon DBIR report is packed with valuable insights. To answer the questions, focus on the sections confirming that:

Adversaries are using adminware and RMM tools (AnyDesk, ScreenConnect) more than ever Valid accounts harvested by infostealers and sold by IABs are then used in ransomware attacks. https://www.verizon.com/business/resources/T1ae/reports/2026-dbir-data-breach-investigations-report.pdf

### Answer the questions below

The GitHub breach started from an infection of an employee's device. Which VS Code extension was backdoored with an infostealer? `Nx Console`

The extension was compromised through another supply chain attack. Which open-source package ecosystem was the root cause? `TanStack`

Open the Verizon report to page 40 (System Intrusion section). How much has threat actor RMM usage grown year-over-year? (e.g., 50%) `240%`

Continue to the Infostealer to ransomware pipeline section a few pages later. Which access type do Initial Access Brokers most commonly sell? (e.g. SSH) `VPN`