When Insider Threats Take Six Months to Execute: This Week's Reality Check

Page content

When Insider Threats Take Six Months to Execute: This Week’s Reality Check

This past week reminded me why I tell my team that modern security threats don’t follow the playbooks we wrote five years ago. Between a $280 million crypto heist that took half a year to orchestrate and zero-days getting exploited faster than we can patch them, it’s clear we’re dealing with a fundamentally different threat environment.

The Long Game: How Drift Lost $280 Million

The most sobering story this week came from the Drift Protocol hack. This wasn’t your typical smash-and-grab crypto theft. The attackers spent six months building “a functioning operational presence inside the Drift ecosystem” before making their move.

Think about that for a moment. Six months. That’s longer than most of our security awareness training cycles. It’s longer than many penetration testing engagements. These attackers were essentially running a legitimate-looking business operation while planning one of the largest crypto thefts we’ve seen.

What makes this particularly concerning is how it challenges our detection strategies. Most of our monitoring focuses on anomalous behavior, but what happens when attackers take the time to establish what looks like normal, legitimate activity? When someone spends half a year building credibility and operational cover, they’re not showing up on our usual threat hunting dashboards.

Zero-Days Are Moving Faster

Speaking of detection challenges, Fortinet had to rush out emergency patches for a zero-day in FortiClient EMS that was already being exploited in the wild. The improper access control bug allows unauthenticated attackers to execute arbitrary code remotely – basically the worst-case scenario for any network security appliance.

This hits particularly close to home because FortiClient EMS is deployed across so many enterprise environments. When a tool designed to secure your network becomes the entry point for attackers, it creates a trust problem that goes beyond just applying patches. How many organizations are going to be questioning their entire Fortinet deployment strategy after this?

The speed at which this zero-day moved from discovery to active exploitation also reflects something we’re seeing more often. The window between “vulnerability exists” and “vulnerability is being exploited” keeps shrinking. We used to have days or weeks to respond. Now we’re measuring response time in hours.

Shadow AI: The Healthcare Wild West

Meanwhile, healthcare organizations are grappling with what might be our next major blind spot: shadow AI. According to recent analysis, medical professionals aren’t going to stop using AI tools to manage their growing workloads, regardless of what IT security policies say.

I’ve seen this pattern before with cloud adoption and mobile devices. When users find tools that genuinely help them do their jobs better, they’re going to use those tools whether we’ve approved them or not. The question becomes: do we try to lock everything down and drive usage further underground, or do we figure out how to secure these tools properly?

In healthcare, the stakes are particularly high. We’re talking about AI tools that could be processing patient data, influencing treatment decisions, or integrating with critical medical systems. The potential for both privacy violations and patient safety issues is enormous.

Microsoft’s Quiet Cleanup

On a lighter note, Microsoft quietly removed the Support and Recovery Assistant (SaRA) command-line utility from Windows updates starting March 10. While this might seem like routine housekeeping, it’s worth noting because SaRA was one of those tools that could be useful for both legitimate system administration and potential misuse.

This kind of attack surface reduction is exactly what we want to see from vendors. Every utility, every command-line tool, every API endpoint is a potential entry point for attackers. When Microsoft removes tools that aren’t essential, they’re making our job a little bit easier.

What This Means for Our Planning

Looking at these stories together, I see a few patterns that should influence how we’re thinking about security strategy. First, we need detection capabilities that can identify long-term, slow-burn attacks. The Drift case shows us that attackers are willing to invest serious time in establishing legitimacy before striking.

Second, our patch management processes need to assume that zero-days will be exploited immediately. The old model of “test for a week, then deploy” doesn’t work when attackers are moving this fast.

Finally, we need to get ahead of shadow IT trends like unauthorized AI usage. Rather than trying to block everything, we should be asking how we can provide secure alternatives that meet the same user needs.

The threat environment keeps evolving, but so do our capabilities to address it. We just need to make sure we’re evolving in the right direction.

Sources