Entrar
LevelBlue TTP Briefing Q3 2026: Trusted Access Fuels Data Theft
Explore the latest tactics, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing in the quarterly TTP Briefing, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue during Q3 2026.
A Unified View of the Threat Landscape
This TTP Briefing is based on threat intelligence derived directly from LevelBlue incident response engagements worldwide over the past quarter. These engagements are technology-agnostic, providing a clear view into the real-world tactics, techniques, and procedures adversaries are using today.
The latest edition also incorporates threat intelligence from LevelBlue SpiderLabs, which broadens the dataset behind our findings.
Trusted Access Fuels Data Theft
The theme of the quarter: trusted access fuels data theft. Attackers didn’t need to break in so much as log in. Session tokens captured by phishing kits, OAuth apps users consented to, VPN appliances that accepted forged authentication, and remote management tools that look like routine IT all gave threat actors a foothold that looked legitimate from the inside. Once there, they went after data. We observed data exfiltration appearing in 83% of intrusion cases, while encryption is at 67%. In Q2, both were 77%. Non-ransomware network intrusions were the second most common incident type, and for the first time, exfiltration overtook viewing or accessing files as the most common outcome when data was at risk.
This briefing breaks down what our IR teams saw this quarter: who was targeted, how attackers got in, what they did once inside, and how fast they moved. Each section closes with guidance defenders can act on now.
Across our investigations this quarter, four themes stood out: attackers are diversifying initial access methods, identity has become a primary battleground, data theft is increasingly replacing encryption as the preferred source of leverage, and both attackers and defenders are moving faster than ever.
For additional insights, join our IR experts on November 10 at 11:00am ET or November 12 at 11:00am GMT for live webinars where they will explore our findings in more detail. Come armed with questions and walk away with actionable intelligence, detection priorities, and recommendations to strengthen your defenses.
Let’s explore a few key findings:
Most Common Threat Types
Figure 1. Most common threat types.
- BECs continued to be the most common threat incident type, accounting for 32% of incidents.
- Network intrusions without ransomware held steady as the 2nd most common incident type at 22%. This is largely due to threat actors focusing on exfiltration and extortion, rather than encryption.
- Ransomware was the 3rd most common incident type, accounting for 20% of incidents this quarter.
Detection built around encryption events will miss a growing share of intrusions. Watch for large outbound transfers, unusual archive creation, and new cloud storage destinations.
Data Exfiltration Becomes the Focus for Attackers
Exfiltration/extortion-only attacks were the fastest-growing category in Q3, with attackers stealing data and threatening to publish it without deploying ransomware. Attacks that combine encryption with exfiltration remain the most common, but their share has fallen each quarter. This suggests encryption is no longer a given in ransomware cases, and the leverage increasingly comes from the stolen data itself.
Figure 2. Intrusions.
The tools observed during investigations reinforce this trend. Utilities such as rclone, MegaSync, WinSCP, 7-Zip, and WinRAR continue to play an important role in attacker workflows, helping collect, package, and transfer sensitive information outside the organization.
Protecting systems remains essential, but organizations must also understand where their most sensitive information resides, who has access to it, and how they will detect abnormal movement or exfiltration activity before data leaves the environment.
Initial Intrusion Vector (How Are They Getting In?)
Figure 3. Initial intrusion vectors.
Phishing remained the top initial intrusion vector in Q3 at 42%, down from 65% in Q2. External remote services (RDP, VPN) and exploited vulnerabilities tied for second at 14% each. Together, those two internet-facing routes now account for more than a quarter of initial access.
Identity Is the Thread Through the Intrusion
- Valid-account abuse has grown in each quarter. It is still a small share of initial access, but the direction is clear.
- Social engineering often ends in stolen identities. Phishing/social engineering remains the most common way in, and that category includes vishing and help-desk impersonation. Many of those cases result in stolen credentials or tokens, so identity likely plays a larger role than the valid-accounts bar alone shows.
Most Commonly Observed CVEs – Q3
These are the vulnerabilities our incident response teams saw actively exploited in real incidents this quarter, which makes them a sharper patching priority list than any CVSS score.
| CVE-2026-0257 |
PAN-OS Global Protect |
| CVE-2026-25639 |
Axios TypeError |
| CVE-2026-72898 |
Metabase |
| CVE-2025-13407 |
Gravity Forms WordPress plugin |
| CVE-2024-40762 |
SonicWall SonicOS SSLVPN |
| CVE-2024-40766 |
SonicWall SonicOS SSLVPN |
| CVE-2024-53704 |
SonicWall SonicOS SSLVPN |
| CVE-2024-53705 |
SonicWall SonicOS SSRF |
| CVE-2022-26923 |
Active Directory Domain Services |
Inside the CVE Numbers:
Inventory internet-facing business applications, not just network appliances. If it touches sensitive data and faces the internet, it belongs on the emergency patch list.
Exploitation Is Back, and Initial Access Diversifies
While social engineering remains a top concern, internet-facing flaws have increased as an initial access route, with CVEs and external remote services both rising in Q3. Attackers are using a wider mix of entry points, including vulnerabilities like Metabase.
A look at Metabase - CVE-2026-72898
A vulnerability was discovered earlier this quarter in Metabase, an open-source business intelligence and data visualization platform. Identified as CVE-2026-72898, this vulnerability allows for unauthenticated SQL Injection that could lead to remote code execution with a cvss score of 10. If exploited, this vulnerability could allow a threat actor to hijack an account and gain admin access to the connected Metabase instance. From there, we observed threat actors creating new admin accounts, and leveraging the AI engines to gain access to 3rd parties connected to Metabase, and exfiltrating data from there and extorting the victim. This vulnerability allowed for a fully self-contained intrusion path from initial access through end goal.
MFA Bypass
Figure 4. MFA bypass.
MFA is close to universal among the organizations we respond to, yet it no longer stops business email compromise attacks. In Q3, threat actors bypassed MFA in 79% of BEC incidents where it was enabled.
Although MFA remains widely deployed, attackers are increasingly sidestepping it through vishing, convincing victims to enroll an attacker-controlled device on their account. Because the victim approves the registration, the access appears legitimate, reflecting a shift from token interception to abuse of trusted device enrollment. Additionally, threat actors are relying more on machine identity and token abuse, rather than a normal user account attack, which does not involve bypassing MFA, contributing to the dip in our bypass stat.
Because attackers increasingly rely on valid tokens rather than defeating the prompt, pair MFA with continuous session-token monitoring, short token lifetimes, and conditional-access policies that flag anomalous token use.
The lesson is clear: identity security cannot be a standalone initiative. Organizations should pair phishing-resistant MFA with stronger monitoring of enrollment activity, conditional access controls, and greater visibility into account misuse across cloud and on-premises environments.
Most Targeted Industries and Company Sizes
Figure 5. Most targeted industries.
Targeted industries saw a shift in Q3. Financial services, which had been the top impacted sector for the last few quarters, dropped to #4, accounting for only 11% of incidents in Q3, down from 28%. Technology & Software surged to the top spot, accounting for 14% in Q3, up from 5% in Q2, and 3% in Q1. Healthcare and Manufacturing tied for the 2nd spot at 13%. This shift demonstrates that no industry is off limits to threat actors, and every sector should focus on cyber resilience.
Technology & Software spike: We observed an increase in compromised custom software and applications via exposed API keys, a trend that became more common in Q3 as threat actors used AI to hunt for exposed keys as an entry point into custom technologies. Because API keys are often long-lived, over-permissioned, and bypass MFA, a single exposed key can give direct access to sensitive data and connected systems. That reach, which can extend to a provider’s customers, makes the sector an attractive target.
Organizations with revenue between $1M–$100M accounted for the largest share of incidents in Q3, reinforcing that threat actors increasingly view mid-market companies as high-value, lower-resistance targets.
Tactics Across the Intrusion Path
Figure 6. Trends across the intrusion path.
The TTP Briefing provides data across the five stages of the intrusion path, from initial access to persistence and escalation techniques, to exfiltration and monetization tactics. Noteworthy findings include:
- Back door/remote access tools remain the most common tool type leveraged to gain persistence, using tools like ScreenConnect and MeshAgent to maintain access.
- Credential stealers, like mimikatz and DCSync, continue to be commonly used to escalate privileges, as identity compromise remains a top concern.
- During the data at risk stage of the intrusion path, files were most often exfiltrated, surpassing viewed/accessed for the first time, highlighting that threat actors are focusing heavily on data exfiltration.
A Look Into Dwell Time
Figure 7. Dwell time.
In the TTP Briefing, we exclude any MDR clients and measure dwell time from the initial date of the compromise until our IR team is engaged. This quarter, average dwell time continued to decrease, with 56% of incidents being resolved between 0-10 days. Shorter windows can mean faster detection, faster attacker execution, or both, and in Q3 we saw plenty of the latter.
What the shift says: Attackers are executing faster than we have ever seen. Some intrusions now play out in hours instead of days, with threat actors using AI tools to move through networks. Detection is improving, but so is attacker speed.
Review the full findings:
If you would like more information about this report, our team is available 24/7 at response@levelblue.com
