The most dangerous attacker of the past year looked completely ordinary
When Anthropic's threat intelligence team ranked a year of AI-enabled cyberattacks, the most dangerous operation in the dataset didn't stand out by the measure the security industry has relied on for years.
Mapped against MITRE ATT&CK, the state-sponsored espionage campaign Anthropic disrupted in November 2025 used 30 techniques across 13 tactics, comparable to many medium-risk actors in the same dataset. Against Anthropic's own risk methodology, the same campaign scored the maximum of 100.
Senior Director, Security Engineering & Operations at Cribl.
The fact that the highest-risk actor looked unremarkable by technique count exposes a weakness in conventional detection thinking. Technique breadth alone tells defenders relatively little about risk. More useful insight comes from understanding how techniques are combined, sequenced and executed over time.
The indicator was always the fragile part
Security operations spent two decades getting very good at recognizing evidence an attacker had already used. Malwarehashes, malicious IP...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE
