Circling Dragons: Red Team Lessons From Modern Breaches

Jason Lang, a red team practice lead, reads public breach reports from the attacker's side rather than the defender's. He argues that breach write-ups often describe intrusions as sophisticated to make the victim look less negligent, and he sorts the cases he reviewed into novice, professional and nation-state groups.

The novice case was a database server exposed to the internet, brute-forced and followed by ransomware in under an hour. The professional cases included a Caesars intrusion tied to Scattered Spider, where help desk social engineering and identity infrastructure played a role, and a cloud company breach where the intruder read internal documentation, planted persistence and was caught after escalating too quickly. The nation-state examples involved zero-day exploitation of email gateways and firewall management tools, with attackers living inside network devices rather than relying on common Active Directory techniques.

For practitioners, Lang's takeaways are to scale the attack to the target's maturity, monitor before acting, slowly work existing access and internal applications, keep backup access in place, and aim for the effect rather than copying a specific exploit. He also argues that phone-based social engineering is often the most effective first step, and that real intrusions depend on many steps succeeding in sequence.