Threat Outlook: Modern Threat Actor's Playbook

Read the findings in their original timeframe

Despite the 2025 filename, the supplied document is titled ‘From Initial Access to Ransomware Deployment: A Deep Dive into the Modern Threat Actor’s Playbook’ and identifies itself as a 2023 review with a 2024 outlook. Its predictions are therefore presented here as forecasts for 2024, not as findings about 2025.

The analysis draws on eSentire Threat Response Unit (TRU) observations. Its intrusion ratio measures the share of incidents progressing beyond initial access, rather than the share of organizations experiencing an attack. The report’s conclusions should be read in that observed-customer context.

Initial access is shifting toward the browser

TRU identifies browsers, email, removable media, unknown vectors and remote exploits as its five leading initial access vectors by attack volume. The report describes a shift from email toward browser-based threats, potentially reflecting attackers’ adaptation to stronger email-focused awareness training.

Browser-based social engineering often persuades employees to download and execute malicious content while searching for software or information. Training should therefore cover ordinary web browsing as well as suspicious messages.

• Malvertising places advertisements that direct users to malware disguised as legitimate software.
• SEO poisoning promotes attacker-controlled pages in search results for likely search terms.
• Watering-hole attacks compromise websites that intended victims already visit.
• Free or cracked software downloads can bundle legitimate files with adware, remote access trojans or infostealers.

Unmonitored endpoints hide the beginning of an attack

Out-of-scope endpoints are devices not adequately covered by endpoint monitoring or endpoint detection and response (EDR). If the first compromised device is outside that coverage, investigators may lack the telemetry needed to establish how access occurred. The resulting ‘unknown’ vector reflects a visibility gap, not necessarily a novel attack technique.

TRU found that ransomware attacks originating on out-of-scope endpoints progressed further through the attack lifecycle. Attackers can use these systems as staging grounds for lateral movement, data theft and ransomware preparation.

Complete asset discovery and endpoint coverage are therefore foundational. Network and log monitoring provide important complementary evidence, particularly around VPN activity, but usually cannot replace endpoint telemetry for investigating initial access.

Prioritize impact as well as attack frequency

The most frequent entry methods were not necessarily the most consequential. TRU identifies valid credentials, supply-chain compromise and misconfigurations as the highest-impact initial access vectors, with observed intrusion ratios reaching 100% in the report’s comparison. These are results from the observed incidents, not universal probabilities.

Stolen credentials allow attackers to resemble legitimate users, and TRU frequently saw credential abuse intersect with unmonitored endpoints. Supply-chain access can exploit trusted third parties or software and expose sensitive customer information. Misconfigurations can similarly provide pathways that bypass intended controls.

Industry context affects visibility. Education, healthcare and government often have large, interconnected networks and restrictions on monitoring deployment. Smaller network footprints can be easier to scope, although mergers and government connections can complicate boundaries, including in the legal sector.

Reduce the opportunity for initial compromise

The report recommends combining user education with technical controls rather than relying on either alone. Coverage must extend to all relevant endpoints and remote access services.

• Use realistic awareness exercises covering browser-based social engineering and email threats.
• Deploy EDR comprehensively and verify coverage through asset discovery and inventory management.
• Maintain 24/7 network and log monitoring; restrict remote access services or place them behind a VPN.
• Enable multifactor authentication across accounts, limit access to managed and compliant systems, and deactivate authentication sessions after compromise.

Intrusion ratios are rising alongside remote access abuse

TRU reports a steady rise in intrusion ratios from 2021 through 2023, reaching nearly 50% across its global customer base. In practical terms, almost half of observed initial breaches progressed to intrusion activities such as persistence, credential gathering or lateral movement; this does not mean every such incident achieved its final objective.

The report associates that increase with greater use of remote access trojans and legitimate remote access tools. Trojans can act as infostealers or backdoors and often arrive through browser-based downloads. Legitimate management tools can then support hands-on-keyboard activity and movement across a compromised environment.

TRU observed declining use of Cobalt Strike alongside greater use of tools such as NetSupport RAT, AsyncRAT, Remcos and Sectop RAT. It also describes abuse of ConnectWise, AnyDesk, BloodHound and PsExec, and browser-delivered threats including GootLoader, Nitrogen and SocGholish. Retail, utilities, software, government and healthcare featured prominently in its ransomware intrusion analysis.

Interrupt lateral movement and privilege escalation

Once attackers establish a foothold, defenses must constrain access and expose movement between systems. The report recommends applying zero-trust principles internally while making legitimate access requests practical for employees.

Comprehensive monitoring must include domain controllers, workstations and servers. VPN and domain-controller logs can help reconstruct movement, identify initial access and establish whether an attacker obtained domain administrator privileges. TRU also describes attackers registering their own virtual machine in a VPN pool, making VPN logs critical to distinguishing the underlying source.

• Use internal firewalls to restrict unnecessary machine-to-machine access.
• Begin with least privilege, require additional access requests, expire elevated access and remove obsolete accounts.
• Monitor internal network traffic for lateral movement, credential collection and command-and-control beaconing.
• Eliminate endpoint coverage gaps that could provide staging grounds for intruders.

Understand ransomware, coinmining and information theft

The final stage of an attack is the objective itself: encrypting files, exfiltrating data, disabling systems or otherwise exploiting access. The presence of a tool can indicate intent and attack progression without proving the objective was achieved.

TRU identifies ransomware as the highest-impact objective and reports increased activity in the latter half of the year, suggesting attackers may seek periods of weaker defenses. Valid credentials were the initial access vector most likely to lead to ransomware in its data. The report also cites its 2024 SMB Ransomware Readiness Report, highlighting SMB victims in manufacturing, business services and retail.

Coinminers generally cause less impact than ransomware but still demonstrate unauthorized code execution. TRU associates them with unknown vectors and remote exploitation, often on public-facing servers with limited network privileges.

RATs and infostealers can steal credentials and other valuable information while also serving as loaders or lateral movement tools. Stolen single sign-on credentials can enable ransomware, email credentials can facilitate business email compromise, and stolen wallets or sensitive information can support theft or espionage. Resold or reused credentials blur the boundary between separate attacks.

Prepare to contain incidents and restore trusted operations

Resilience requires continuous risk assessment, 24/7 detection and response, and real-time telemetry that supports prompt containment. Redundant processes help sustain operations if critical systems are compromised.

The report recommends isolating affected systems and locking out accounts during investigation, examining account activity on other systems during the compromise window, and restoring systems to a known good state. Revoke active sessions and reset compromised credentials after cleanup.

Maintain and exercise an incident response plan and a communications plan, including ransomware response and notification procedures. Technical recovery and coordinated communication should be prepared together.

The 2024 outlook: political disruption and a professionalized crime ecosystem

Looking ahead from 2023, the report anticipated more politically motivated attacks around 2024 elections. It warned that hacktivists and state-sponsored actors could combine disruptive activity with AI-generated misinformation to undermine trust and deepen social divisions.

It also forecast a more professionalized ransomware economy. Beyond providing malware to affiliates, experienced operators could offer consulting-like support for branding, staffing, technical resources, escrow, money laundering and reputation management, including advice on retiring brands after sanctions or law-enforcement action.

The report presents potential cooperation between ransomware groups and government entities as a possibility, not an established outcome. It also anticipated deeper specialization across criminal roles and further investment in zero-day exploits and supply-chain attacks.

The 2024 outlook: AI, infrastructure, edge devices and RMM

The report forecast that generative AI adoption would expand the attack surface, especially where models connect to internal datasets. It highlights prompt injection and malicious code injection risks, while anticipating that attackers could use their own AI models to scale personalized social engineering and streamline intrusion activity.

Critical infrastructure, including energy, water, transportation and healthcare, was expected to remain a target for state-sponsored and state-aligned groups using espionage, destructive malware or dormant access. The recommended response combines proactive threat intelligence, round-the-clock security operations and robust incident response.

TRU also anticipated increased exploitation of zero-day vulnerabilities in edge devices such as routers, IoT devices and sensors. It recommends timely patching, regular security audits and advanced detection to reduce exposure and identify exploitation.

Finally, the report expected continued abuse of remote monitoring and management tools following an increase in 2023. Strong access controls, continuous monitoring, behavioral analytics, multifactor authentication and up-to-date RMM software are central safeguards.