Why Threat Actors Prefer Repeatable Attacks Over Clever Ones
Last year, the most common way into a corporate network was simply asking. Microsoft's threat intelligence team reported that ClickFix — a social engineering technique that walks a user through a fake CAPTCHA while quietly placing a command on their clipboard, then instructs them to paste it into a terminal — accounted for 47% of all observed initial access attacks in their notifications. No attachment arrives, so there is nothing for a mail gateway to flag. No exploit is used, so there is nothing to patch. The payload, in effect, is the user themselves. Separately, Bitdefender's analysis of 700,000 security incidents found that 84% of high-severity cases involved living-off-the-land binaries — the same administrative utilities IT teams use every day. Nothing malicious was installed, because nothing malicious was needed.
Verizon's latest Data Breach Investigations Report reinforces the pattern: exploitation of vulnerabilities is now the most prominent initial access vector, rising to 31% from 20% year-over-year, a 55% jump in the one category that rewards scanning over skill. Edge devices are favored not because they are interesting targets, but because the playbook is short enough to write on an index card. The procedure is familiar: monitor for new CVEs in internet-facing systems, filter for unauthenticated remote code execution, wait for a working proof of concept to land on GitHub — usually within days — and then mass-scan the internet for anything unpatched. Defenders can audit their own exposure to this exact workflow with a port scanner and an SSL/TLS checker to identify which services are publicly reachable and how they are configured before an automated campaign does.
The strategic takeaway is that criminal operations are not optimizing for cleverness — they are optimizing for repeatability. A group that must invent a new technique for every victim cannot scale; a group with a documented procedure and a target list can grow as fast as it can enumerate assets. The economics mirror generics pharmaceutical manufacturing: the research is done elsewhere, often by a legitimate security researcher publishing a public PoC on a predictable schedule, and the attacker simply produces the known formula at volume. Exposure, not identity, becomes the selection criterion, and whoever the victim turns out to be stops mattering very much.
For defenders, the implication is uncomfortable. Patch hygiene, exposed-service reduction, and clipboard-aware user training now outweigh any investment in chasing novel tradecraft, because attackers are deliberately selecting the lowest-friction path that works the same way at the next company and the one after that. Running a WHOIS lookup on your own infrastructure is a small but practical starting point: it surfaces the registration details, name servers, and contact records that often end up in the same reconnaissance feeds that feed these automated target lists long before a researcher publishes the next weaponizable exploit.