Sponsored by: minute read Share this article: The time that attackers stay hidden inside an organization’s networks is shifting, putting pressure on defenders and upping the need to detect and respond to threats in real-time. Cyberattacks have shifted from the usual smash-and-grab type of heists to stealthier campaigns where hackers silently camp out on networks for long periods, stealing anything they can get their hands on. Called attacker dwell time, this is part of an adversarial approach that has become even more popular with hackers when it comes to 2021 ransomware attacks and data breaches. Consider recent ransomware attacks by cybergangs Ryuk and Maze, where adversaries lurked in the datacenter shadows and within endpoint crevices – collecting counterintelligence, stealing credentials and pushing malware laterally. Only after pilfering all of a company’s digital goods did criminals finally encrypt files and demand a ransom, in what’s become an increasingly common “double extortion” attack.