Repeatable Attack Playbooks Are Driving Cybercrime at Scale
Cybercriminal groups are increasingly relying on repeatable procedures rather than novel attack techniques. Microsoft observed that ClickFix accounted for 47% of the initial-access attacks in its notifications last year, while Bitdefender found that binaries already present on affected machines appeared in 84% of the high-severity incidents it analysed from a pool of 700,000 security incidents.
ClickFix uses a web page that instructs a visitor to complete a supposed verification step while placing a command on the clipboard. The victim is then guided to open a terminal and paste the command. The method does not require an attachment to scan or a vulnerability to patch, making it useful as a reusable social-engineering sequence.
Scale favours standardised procedures
Verizon’s latest Data Breach Investigations Report identified vulnerability exploitation as its most prominent initial-access vector, reaching 31% of cases, compared with 20% a year earlier. The source describes a straightforward targeting process: watch internet-facing devices for new CVEs that permit unauthenticated remote code execution, wait for a public proof of concept, and scan at scale for systems that remain unpatched.
This approach does not require a group to develop a new exploit for every victim. Publicly available proof-of-concept code and exposed infrastructure allow the same operational sequence to be used repeatedly. The selection criterion becomes exposure rather than a particular organisation’s identity or technology stack.
The same emphasis appears in ransomware activity. Qilin claimed roughly 1,600 victims over more than a year, while The Gentlemen claimed 121 victims in June, compared with Qilin’s 80. Those are self-reported leak-site figures rather than audited totals, but they illustrate competition in volume. Bitdefender said The Gentlemen emerged from a former Qilin affiliate and showed how ransomware playbooks can be recycled and improved.
Built-in tools reduce adaptation work
Living-off-the-land activity extends the same model beyond initial access. Attackers can use scripting engines, remote-management utilities, archive tools and administrative binaries already installed in an environment. These tools are familiar and broadly available, allowing an operator to repeat a known sequence without bringing separate tooling or adapting it to each target.
Such activity can also be difficult to distinguish from legitimate administration. A remote-management tool, an account sign-in and cloud-storage traffic may each be normal in isolation. The relevant signal can be the sequence of those events, their timing and the host involved, rather than any single action.
Defences should disrupt the common sequence
Verizon reported ransomware in 48% of breaches, up from 44%, while 69% of ransomware victims did not pay and the median payment fell from $150,000 to $139,875. Bitdefender counted 704 organisations claimed as ransomware victims on leak sites in June 2026. The source argues that a higher-volume, lower-return environment rewards cheaper and more repeatable operations.
For defenders, that makes prioritisation more concrete. Internet-facing vulnerabilities offering unauthenticated remote code execution should be identified and patched quickly, ideally before public proof-of-concept code is widely used. Application control and script-execution policies can interrupt ClickFix when a pasted command would become a process.
Businesses can also restrict access to scripting and remote-management utilities, reduce shared credentials and overly broad service accounts, and correlate events across identity, endpoints and cloud services. Finally, endpoint detection requires active monitoring and an accountable responder. The practical implication is to focus security investment on breaking the small number of repeatable paths attackers can use at scale.