Threat Actors Breach Enterprise Infrastructure Within 18 Minutes of Initial Access

Threat actors are accelerating their foothold in corporate networks, with the average time from initial breach to lateral movement dropping to 18 minutes in the June–August 2025 period, according to GBHackers’ summary of the period. In one incident, Akira ransomware operators moved laterally in six minutes after compromising a SonicWall VPN, underscoring the urgency of closing detection gaps and automating responses.

Drive-by compromises remained the leading entry point at 34%, fueled by the Oyster campaign, which uses SEO poisoning and malvertising to lure victims to trojanised IT-tool download sites delivering backdoors via malicious DLLs and using Rundll32.exe for stealth and persistence.

The report highlights RDP as the top lateral-movement technique, with SMB-based ransomware operations rising to 29%, and notes an increase in IP-KVM devices used to bypass endpoint protections; nation-state actors accounted for 56.7% of cases in this period. It also cites exploits such as CVE-2024-40766 for SonicWall VPN and CVE-2024-55591 and CVE-2024-21762 for Fortinet FortiGate.

According to ReliaQuest GreyMatter’s automated containment, mean time to contain fell to 4.49 minutes, reflecting a push toward automation and real-time hardware monitoring to curb breakout times.