Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

The argument that threat actors do not necessarily want “better” attacks but instead want attacks that can be repeated reliably is one of the more useful ways to understand modern cybercrime. Security discussions often focus on sophistication: zero-days, artificial intelligence, advanced malware, new exploitation frameworks and highly capable autonomous agents. Criminal operations, however, have a different optimization problem. Their objective is not to produce technically impressive attacks. Their objective is to compromise as many viable victims as possible while minimizing the cost, skill, time and uncertainty associated with each compromise. From that perspective, an attack technique that works against thousands of organizations with minimal modification can be considerably more valuable than a brilliant technique requiring an expert operator to redesign the intrusion for every target.

This helps explain why techniques such as ClickFix have become so attractive. The attacker does not necessarily need to discover a vulnerability, develop malware capable of bypassing every endpoint product or create a sophisticated exploit chain. Instead, a compromised or malicious webpage can tell the victim that a CAPTCHA, browser verification or technical problem requires a simple action. The user is instructed to copy a command, open Windows Terminal, PowerShell or the Run dialog and execute it. At that point, the victim has effectively performed the initial execution step on behalf of the attacker. There may be no malicious attachment for an email gateway to scan and no software vulnerability for the operating-system vendor to patch. The attack succeeds because the attacker has standardized a human interaction that can be repeated across many organizations.

This is not merely a social-engineering trick. It is a business model. Criminal groups benefit enormously when an attack can be converted into a documented procedure that operators with moderate technical skills can repeat. The more deterministic the procedure, the easier it becomes to distribute through an affiliate ecosystem, outsource individual stages and automate reconnaissance. An attacker who needs an elite researcher to understand every victim environment cannot scale easily. An attacker who can hand an affiliate a short playbook saying “find an exposed product, run this exploit, execute these commands and deploy this tool” can attack thousands of organizations.

Vulnerability exploitation follows the same economics. Attackers do not necessarily need to discover original vulnerabilities themselves. They can monitor vendor advisories, CISA’s Known Exploited Vulnerabilities catalog, security research and public proof-of-concept repositories. Once an unauthenticated remote-code-execution vulnerability appears in a widely deployed internet-facing product, the economically rational approach is often to wait for enough technical information to reproduce it and then scan the internet for systems that have not yet been patched. The research cost may have been borne by a security researcher, vendor or another attacker. The criminal operator’s primary requirement becomes speed and scale.

This changes how organizations should think about vulnerability prioritization. The traditional approach of attempting to patch every critical vulnerability equally can become overwhelming because enterprises may have thousands of findings. Attackers are more selective. They prefer vulnerabilities that are externally reachable, easy to exploit, require no credentials and provide a useful post-exploitation capability such as remote command execution or authentication bypass. Defenders can use exactly the same selection criteria. An internet-facing unauthenticated RCE should generally receive dramatically greater urgency than a high-CVSS vulnerability requiring local access and complex prerequisites.

The important security race therefore begins at disclosure. Once an attractive vulnerability becomes public, there is often a narrowing window between patch availability and widespread exploitation. Organizations capable of identifying affected assets and deploying fixes inside that window can effectively remove themselves from the attacker's commodity playbook. Organizations that require several weeks of approval, testing and maintenance scheduling may remain inside the attacker's target population long after reliable exploit code becomes available. Attackers do not necessarily need to target those organizations intentionally. Automated scanning discovers whichever systems remain exposed.

This explains the continuing attraction of edge infrastructure such as VPN gateways, firewalls, remote-access appliances and application gateways. Such systems are not targeted simply because they are technologically interesting. They are attractive because they are externally reachable by design and often sit directly between attackers and internal networks. A reliable unauthenticated exploit against an edge device can therefore be executed across large numbers of organizations using nearly identical steps. The attack procedure becomes repeatable, and the identity of the eventual victim may matter less than whether the vulnerable service responds.

Living-off-the-land techniques represent the same logic after initial access. Instead of bringing a large collection of custom hacking tools into every environment, attackers increasingly use PowerShell, command interpreters, WMI, scheduled tasks, remote-management utilities, archive programs and other legitimate software already installed on the victim’s system. These tools are attractive partly because security products may trust them, but repeatability is equally important. PowerShell behaves substantially the same way across large numbers of Windows environments. An operator can learn one sequence of commands and reuse it against many victims without repeatedly porting custom malware.

This makes living-off-the-land behavior particularly challenging for defenders because individual events frequently look legitimate. PowerShell execution is normal. An administrator connecting remotely is normal. An archive utility compressing files is normal. A user authenticating to cloud storage is normal. The malicious pattern often appears only when those events are considered together. PowerShell launched unexpectedly from a user process, followed by credential discovery, large-scale file collection and an unusual outbound transfer presents a very different security context from any individual event alone.

Security monitoring therefore needs to move from simple indicator detection toward behavioral correlation. Looking only for malware signatures becomes less useful when attackers deliberately avoid introducing distinctive malware. Detection systems need to understand process ancestry, user identity, timing, network destination and historical behavior. The security question changes from “Is PowerShell malicious?” to “Why did this particular employee's workstation launch PowerShell in this context and then communicate with these systems?”

The same argument applies to cloud services. Attackers increasingly route command-and-control traffic, file transfers or phishing infrastructure through platforms that organizations already trust. Blocking an entire cloud provider may be operationally impossible, which gives attackers another standardized communications mechanism. Again, stealth is certainly useful, but consistency matters just as much. A command-and-control technique based on ubiquitous HTTPS or WebSockets can work in thousands of networks without requiring the attacker to study every firewall policy independently.

This is why unrestricted outbound connectivity has become such an important enterprise security weakness. Many organizations spend heavily controlling inbound access while permitting workstations and servers to initiate HTTPS connections almost anywhere. Reverse-tunneling malware can exploit that asymmetry. The compromised endpoint initiates an outbound connection that the firewall permits, and the attacker then routes access back through that established channel. From the perimeter’s perspective, no unsolicited inbound connection occurred.

Application-aware egress controls, DNS filtering and destination reputation can therefore break another part of the attacker's repeatable procedure. The objective is not to block HTTPS. It is to ensure that every executable on every workstation cannot establish arbitrary encrypted tunnels to any destination merely because TCP port 443 happens to be allowed.

The economics described in the article are particularly relevant to ransomware. Ransomware has matured into an industrialized affiliate ecosystem. The most successful operations are not necessarily the groups developing the most sophisticated cryptographic payload. Their advantage often comes from recruitment, infrastructure, negotiation processes, data-leak operations and repeatable intrusion playbooks that affiliates can execute across many victims. The technical attack becomes one component in a larger criminal service.

This explains why ransomware playbooks can survive individual group disruptions. Operators move between groups, affiliates change brands and codebases evolve, but successful procedures persist. A reliable method for gaining initial access, escalating privileges, disabling security products, finding backup infrastructure, collecting data and deploying encryption can migrate from one organization to another. The ransomware brand may disappear while the operational knowledge survives.

Defenders should therefore concentrate less on ransomware family names and more on the repeatable behaviors leading toward ransomware. By the time a particular ransomware binary appears, much of the important intrusion has already occurred. Initial access, credential theft, privilege escalation, Active Directory reconnaissance, backup discovery and data exfiltration may happen hours or days earlier. Detecting those standardized intermediate stages provides much greater opportunity for containment.

The article also raises an interesting challenge to the widespread assumption that autonomous AI will immediately transform offensive cybersecurity. There is no question that AI can accelerate vulnerability research, phishing development, code generation, reconnaissance and analysis. The more nuanced question is whether criminal groups will routinely deploy expensive autonomous agents inside every victim environment when an inexpensive deterministic playbook already produces adequate results.

For high-value targeted operations, autonomous agents could make considerable sense. A state-sponsored actor or sophisticated criminal group targeting one extremely valuable organization may be willing to spend substantial compute and model costs to explore an unfamiliar environment dynamically. The agent could inspect systems, reason about unusual configurations and find attack paths an ordinary script would miss. In that context, improved capability may justify greater per-target cost.

Commodity ransomware and mass exploitation operate under different economics. Their strength comes from processing large numbers of targets cheaply. If the attacker can compromise hundreds of organizations using vulnerability scanning, credential reuse, ClickFix and standard administrative tooling, adding an expensive autonomous reasoning loop to every target may not improve profitability. AI adoption therefore depends not merely on whether agents are technically capable but whether they reduce the attacker's overall cost per successful compromise.

This is an important distinction because cybersecurity forecasts sometimes confuse technical possibility with economic inevitability. Attackers do not automatically adopt every new capability simply because it exists. They adopt techniques when those techniques improve reliability, profitability or scale. Ransomware-as-a-Service became widespread because it allowed specialized developers and affiliates to divide labor efficiently. Double extortion became common because stolen data created additional leverage against victims with strong backups. AI will likely be adopted under the same economic logic.

The most likely near-term use of AI may therefore be behind the playbook rather than replacing the playbook. Threat actors can use models to develop phishing lures, analyze vulnerabilities, generate scripts, translate messages, investigate defensive products and improve malware. Once an effective procedure is created, however, attackers can convert it into deterministic scripts and automation that cost almost nothing to run repeatedly. AI becomes the engineer designing the factory rather than an expensive worker improvising on every assembly line.

That does not mean autonomous attacks should be dismissed. The economics can change quickly. Model inference continues to become cheaper, open models continue to improve and specialized cybersecurity agents may eventually perform effective environment-specific reasoning at very low cost. When autonomous exploration becomes cheaper than maintaining large affiliate teams or manually adapting attacks, criminal adoption could accelerate extremely rapidly. Attackers have demonstrated little sentimental attachment to older techniques when a new model produces better economics.

The useful metric to monitor is therefore not simply whether a research laboratory demonstrates that an AI agent can compromise a benchmark. The more consequential question is whether such an agent can reliably compromise real heterogeneous environments at a lower total cost than existing attack procedures. Reliability, false starts, required supervision and infrastructure cost matter as much as headline capability.

This economic framing actually gives defenders some good news. Repeatable attacks depend on repeatable assumptions. Attackers prefer systems that behave predictably, users who possess unnecessary privileges, exposed services that remain unpatched and built-in administrative tools that anyone can execute. Defenders do not need to anticipate an infinite range of creative attacks. They can concentrate on breaking the assumptions that make the common playbook economical.

Smart patch prioritization is one of those opportunities. Organizations should know which assets are internet-facing and which critical vulnerabilities provide unauthenticated access or remote code execution. Those should receive emergency remediation rather than disappearing into the same vulnerability-management queue as thousands of lower-risk findings. Exposure-aware vulnerability management aligns defensive priorities with the attacker's own selection criteria.

Application control is another powerful mechanism. ClickFix depends on a user being able to paste a command into a scripting environment and have the operating system execute it. If ordinary users cannot invoke powerful scripting or administrative tools unnecessarily, the procedure becomes less reliable. Attackers may be forced to develop another path specifically for that organization, increasing cost and reducing scale.

This does not mean PowerShell should simply be removed from every Windows system. Many enterprises require it for administration. The better approach is to determine which users and applications genuinely require powerful interpreters and restrict execution accordingly. A finance employee may have no legitimate reason to launch PowerShell interactively. A system administrator obviously does. Security policy can reflect that difference.

Application control can similarly restrict trusted executables according to location and behavior. Attackers frequently use signed Microsoft binaries through DLL sideloading or other living-off-the-land techniques. Digital signatures establish publisher identity but do not prove that execution is legitimate in every context. A signed system executable launched from an unusual user-writable directory alongside an unfamiliar DLL should not automatically inherit complete trust.

Identity control may be even more important because repeatable intrusion playbooks often depend upon excessive privileges. A compromised endpoint becomes much more valuable when the logged-in user has administrative access across multiple systems, service-account passwords never expire or the same credentials work throughout the environment. Least privilege reduces the economic value of initial compromise because attackers need additional steps to progress.

Network segmentation works for the same reason. Commodity attacks thrive in flat environments where discovering a credential or compromising one server opens the next stage automatically. If workstations cannot directly reach backup systems, database management interfaces or domain-controller administration services, the standard procedure begins to fail. Attackers must perform environment-specific work to find another route, which is exactly the additional cost repeatable operations try to avoid.

This is an important way to understand Zero Trust. Zero Trust is not simply another authentication product at the edge. Its defensive value comes from removing implicit trust throughout the attack path. An authenticated user should not automatically access every application. An internal workstation should not automatically reach every server. A legitimate administrative binary should not automatically execute for every user. Each removed assumption makes a standardized intrusion less portable between organizations.

Attackers also depend heavily on overbroad service accounts. One compromised application can become enterprise compromise when its service identity has administrative access everywhere. Service accounts should therefore be narrowly scoped, monitored and replaced with short-lived workload identities where possible. If an attacker compromises a web application, the identity inherited from that application should provide only what the application genuinely requires.

Credential reuse similarly improves attacker repeatability. One password collected from an endpoint becomes dramatically more useful if it works on VPN, email, servers and administrative interfaces. Strong identity segmentation and phishing-resistant MFA force attackers to develop additional steps rather than simply replaying one credential across the environment.

The article’s point about monitoring is equally important. Many organizations have invested heavily in EDR, SIEM and other detection platforms but remain vulnerable because alerts are not reviewed quickly enough or because nobody with operational authority receives them. Detection technology without an effective response process simply creates excellent forensic records explaining what the attacker did.

Security operations therefore need clear escalation paths and authority to contain compromised endpoints rapidly. If a detection shows a workstation launching suspicious PowerShell, enumerating Active Directory and communicating with unusual external infrastructure, analysts should not require hours of administrative negotiation before isolating it. Repeatable attacker procedures succeed partly because organizations themselves often respond through slow, fragmented procedures.

Managed detection and response can help organizations unable to maintain continuous internal SOC coverage, but the broader requirement is that someone must actually interpret and act upon signals. Security tools do not protect networks by existing on a licensing invoice.

Behavioral correlation becomes particularly important because standardized attacker procedures often use individually legitimate actions. EDR sees PowerShell. Identity systems see a valid login. Firewalls see HTTPS. File servers see an authenticated user reading files. Every system may independently declare the event normal. A detection architecture capable of connecting those events can recognize that the sequence is not normal.

This suggests that contextual security may become more important than attempting to label every tool as good or bad. PowerShell is neither. A remote-management utility is neither. Cloud storage is neither. Their legitimacy depends upon who is using them, from which system, for what purpose, against which resource and in what sequence.

Organizations should therefore build baselines around expected relationships rather than simply expected software. Which users normally execute scripting tools? Which workstations normally connect to servers? Which accounts legitimately access large numbers of files? Which applications normally communicate with particular external services? Deviations from those relationships can reveal attacks built entirely from legitimate components.

The article also provides an important corrective to the tendency to attribute successful cyberattacks to extraordinary technical sophistication. Many serious breaches occur because basic controls remain inconsistent. Internet-facing systems remain unpatched after reliable exploit code is available. Administrative tools are universally accessible. Service accounts have excessive privilege. Network segmentation exists on architecture diagrams but not in enforcement. Logs are collected but nobody monitors them.

Attackers naturally choose those conditions because they make attacks cheap. A criminal does not gain additional revenue by using a zero-day when an unpatched known vulnerability works perfectly well. There is little incentive to deploy a custom rootkit when a legitimate remote-access tool provides persistent control. Technical sophistication is valuable only when simpler approaches stop working.

This creates a useful defensive strategy: make commodity attacks expensive.

Patch the externally exposed vulnerabilities quickly enough that scanning produces nothing useful. Restrict scripting engines so ClickFix does not convert immediately into execution. Segment networks so an infected workstation cannot reach every important server. Scope service identities so one compromised credential does not unlock the enterprise. Control outbound traffic so reverse tunnels cannot establish themselves anywhere they like. Monitor sequences of behavior rather than isolated signatures.

None of these measures makes compromise impossible. Their value is economic. They force the attacker away from a standardized procedure and toward target-specific adaptation.

That changes the attacker’s calculation.

Suppose a ransomware affiliate scans 10,000 companies using one exploit. If 8,000 remain vulnerable, the attack is highly profitable. If good patch management reduces that number to fifty, the same scanning procedure becomes less attractive. If those fifty also have strong network segmentation and restricted service accounts, the attacker may achieve initial access without reaching valuable infrastructure. Each defensive layer reduces expected return while increasing operator effort.

Security therefore becomes partly an exercise in making the organization an inconvenient victim.

This is much more realistic than promising perfect prevention. Organizations cannot prevent every phishing attempt, every vulnerability and every user mistake. They can design the environment so one successful mistake does not automatically lead through the standard ransomware playbook.

The same reasoning should influence security investment. Organizations frequently purchase technologies marketed around increasingly sophisticated threats while leaving basic execution, identity and segmentation controls incomplete. New technology certainly has value, but the attack data continues to show enormous volumes of compromise through familiar pathways.

If attackers are optimizing for repeatability, defenders should prioritize breaking repeatability.

That includes removing unnecessary internet exposure, because a service attackers cannot reach cannot participate in internet-wide exploitation. It includes rapid remediation of known exploitable edge vulnerabilities. It includes preventing ordinary users from running unnecessary administrative tooling. It includes phishing-resistant authentication, least privilege and controlled service identities. It includes restricting east-west connectivity and outbound internet access. And it includes ensuring that detection produces timely human response.

The argument also changes how organizations should think about AI security budgets. Defenders absolutely need to prepare for faster reconnaissance, AI-assisted social engineering and increasingly capable automated exploitation. However, preparing for autonomous super-hackers while leaving exposed VPN appliances unpatched or allowing every employee to launch unrestricted PowerShell would be a peculiar ordering of priorities.

AI is likely to accelerate the same attack economics before it completely replaces them.

Attackers can use AI to generate more convincing ClickFix lures, analyze public vulnerability patches faster, write scripts more quickly, translate phishing content and summarize reconnaissance. Each of those uses makes existing repeatable procedures more efficient without fundamentally changing the attack model.

That is arguably the more immediate AI threat: not entirely new attacks, but existing attacks becoming cheaper, faster and available to less capable operators.

This could further compress patching timelines. If AI helps attackers compare a vendor patch with vulnerable code and reconstruct the underlying flaw automatically, defenders may have hours rather than days before exploitation begins. Organizations will therefore need automated asset discovery, vulnerability prioritization and patch orchestration capable of operating on comparable timescales.

AI can benefit defenders here as well. Models can help correlate alerts, analyze process chains, explain suspicious command sequences and prioritize vulnerabilities according to exploitability and exposure. The goal should not merely be adding AI to security tooling because everyone apparently requires an AI button now. The useful question is whether automation reduces the time between meaningful signal and defensive action.

The attacker’s repeatability advantage disappears when the defender becomes equally systematic.

Security teams should build their own playbooks around common attack stages. When a user executes suspicious PowerShell after browser activity, the endpoint can be isolated automatically or escalated immediately. When a critical unauthenticated RCE affects an internet-facing appliance, the asset can enter an emergency remediation workflow automatically. When a service account authenticates from a previously unseen workstation, the session can receive additional verification or be blocked.

Standardized defense is the natural answer to standardized offense.

This is perhaps the most useful conclusion from the article. Cybersecurity often presents attackers as infinitely creative adversaries capable of inventing a unique method for every victim. Some certainly can. Most economically motivated attackers have little reason to do so while existing methods continue generating access.

Their dependency on repeatability creates predictability.

ClickFix needs user-driven execution.

Living-off-the-land needs access to powerful legitimate utilities.

Mass vulnerability exploitation needs internet-facing unpatched software.

Lateral movement needs credentials and network reachability.

Data theft needs access to valuable repositories and outbound channels.

Ransomware deployment needs sufficient privilege and reach across systems.

Every one of those dependencies represents an opportunity to break the procedure.

Organizations do not need to win every stage. They need to interrupt enough of them that the standard attack ceases to work.

The strategic objective should therefore be to ensure that compromising the organization requires attacker-specific creativity. If an adversary has to discover a unique exploit, develop custom tooling, understand unusual segmentation and spend considerable time navigating tightly constrained identities, the organization has successfully changed the economics of the attack even if absolute security remains impossible.

That is why boring security controls remain disproportionately valuable. Least privilege, segmentation, application control, timely patching, monitored endpoints and restricted administrative access rarely produce impressive conference demonstrations. They simply make common attacks fail.

Attackers themselves appear to understand the value of boring reliability very well.

The cybersecurity industry occasionally becomes fascinated by the most technically advanced attack imaginable, while criminals continue earning money from procedures that have worked for years. That mismatch can cause organizations to defend against tomorrow’s theoretical attack while leaving yesterday’s proven route open.

The correct lesson is not that sophisticated threats or AI-driven attacks should be ignored. It is that attack economics determine adoption. Threat actors will use autonomy, advanced exploitation and AI agents when those technologies provide a cheaper or more reliable route to compromise. Until then, they will continue using whatever procedure gives them the largest number of victims for the least effort.

For defenders, this creates an unusually practical objective: stop being compatible with the attacker’s standard operating procedure.

If the attack requires an unpatched internet-facing appliance, patch it before mass exploitation begins. If it requires a user to execute arbitrary PowerShell, restrict who can do that. If it requires built-in administrative tools, control their use. If it depends on one credential working everywhere, remove that privilege. If it depends on a flat network, segment it. If it depends on unnoticed activity, ensure someone is actually watching.

The strongest conclusion from the article is therefore not really about attackers at all. It is about defenders. Cybercriminals have industrialized because industrial processes are repeatable, measurable and cheap. Defensive security needs to become equally systematic.

Attackers do not necessarily need a better attack tomorrow. They need the same attack to keep working. The defender’s job is to make sure it does not.

The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix, and it was the most common initial access method Microsoft’s team observed last year, accounting

Source: Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones via The Hacker News — published 01 Sep 2026.