Cybercrime groups speed up initial access handoff through planning, coordination

Dive Brief:

Cybercriminals are becoming much faster at handing off initial access in targeted environments, with the window shrinking to just 22 seconds in 2025, according to a report Monday by Google Threat Intelligence Group and its incident response unit, Mandiant. That compares to about eight hours in 2022.
Exploits remained the leading initial access vector, with 32% of all methods, according to the report. However, voice-based phishing has surged as an initial access vector, rising to the second-leading means of entry, at 11%. Voice-based phishing was the top method for all cloud intrusions, at 23%.
Meanwhile, the global median dwell time rose to 14 days, driven largely by cyber espionage campaigns as well as North Korean IT worker scams, which saw median dwell times of 122 days.

Dive Insight:

The GTIG and Mandiant report is based on analysis of more than 500,000 hours of incident response work Mandiant provided in 2025.

The report found that threat groups are becoming much more deliberate and integrated in how they work with each other. Analysis showed significant coordination and planning for actions during the window between initial access and a secondary actor taking advantage of that access.

During ransomware and extortion incidents, threat groups are increasingly specializing in specific tasks during the attack life cycle, according to Mandiant researchers.

“Often these threat actors establish partnerships with other threat groups where the initial access partner acts as a distribution cluster,” Scott Runnels, consulting leader at Mandiant–Google Cloud, told Cybersecurity Dive. “In these relationships, the secondary threat group’s malware is automatically deployed on a compromised system when the first threat group gains initial access — this is the handoff.”

The report also shows how ransomware groups make it tougher for security teams to recover from attacks. Groups like Akira and Qilin deliberately target backup infrastructure, identity services and virtualization management to frustrate security teams trying to restore critical data.

Such tactics make it more difficult for organizations to avoid paying extortion demands.