CyberSquare

Honest talk on cybersecurity, privacy, and network defense.

How Attackers Go Undetected (and the Psychology That Lets Them)

TL;DR

The Quiet Intrusion

The loud intrusion is dying out. Ransomware still grabs headlines when it detonates, but the intrusions that cause the most damage — the ones that end in exfiltrated data, manipulated infrastructure, or a network held hostage at a politically chosen moment — were quiet long before they were destructive.

Look at Volt Typhoon. Per CISA’s advisory AA24-038A, the group spent years pre-positioning itself inside U.S. communications, energy, transportation, and water/wastewater IT networks, explicitly to enable disruptive lateral movement into operational technology. These weren’t smash-and-grab jobs. The group established persistence in IT networks specifically so that, when the moment was right, it could move sideways into the OT environments that control physical infrastructure. Dwell times of five-plus years have been reported. That’s not an incident. That’s occupancy.

The point of pre-positioning is leverage with patience. An attacker who is already inside doesn’t need to race a detection window; they wait for the conflict, the quarter-end report, the maintenance window, the outage that gives them cover. By the time defenders notice, the attacker’s question isn’t “can we get in” — it’s “what did we miss while we were inside.”

The speed side of the equation changed too. Mandiant’s M-Trends 2026 reported that the attacker hand-off window — the time between initial compromise and the attacker’s hands being on the keyboard — fell from more than eight hours in 2022 to 22 seconds in 2025. Dwell is no longer measured in days of attacker activity; it’s measured in whether your defenses can even register that the first stage happened. Fast operators mean the defenders’ first opportunity to see anything is often the last.

Living Off the Land

Here’s the uncomfortable truth: in most of these intrusions, there is no malware to find. No unique binary, no novel family, no signature waiting to be written. The attacker uses what you gave them.

Living off the land means abusing the legitimate tools that already exist in your environment — remote admin utilities, scripting engines, scheduled tasks, built-in system management features. Every step looks like an administrator doing administrative things, on the machines where administrators are supposed to do them. The traffic is your own traffic. The binaries are signed by your own vendors. The commands are the ones your own IT staff run every day.

This is precisely why detection based on signatures fails so often. A signature is a description of something seen before. Living-off-the-land tradecraft deliberately creates nothing new to see. The activity blends into normal traffic and normal admin behavior because it is, structurally, indistinguishable from them at the layer your sensors watch.

And the tools are trusted by design. Your own organization granted these utilities elevated rights, whitelisted their execution, and told the security stack they’re normal. The attacker doesn’t have to break that trust — they just have to borrow it.

The Psychology That Lets It Happen

Technology gets the blame, but the psychology is where the real gaps live. Four patterns show up again and again.

Visibility bias. We don’t look for what we can’t see, and we don’t build detections for threats we’ve never observed. If your visibility ends at the firewall, at the endpoint agent, at the edge router’s lack of logging, then by definition your model of “normal” excludes everything beyond it. Defenders tune their monitoring to the world their tools show them — and call that world complete.

Alert fatigue. Security teams drown in alerts, most of them noise, most of them triaged away before lunch. When an organization averages tens of thousands of alerts a day, an attacker who wants to hide doesn’t need to evade the sensors. They need to be slightly less interesting than the next thousand alerts. Quiet is the easiest thing to be.

The illusion of the perimeter. The castle-and-moat model died, but a lot of security budgets are still spent maintaining the moat. The firewall, the VPN concentrator, the edge router — these were once the walls. Today they’re the most valuable targets an attacker has, because every organization treats them as trusted boundaries while they’re actually just another hop. The perimeter never made you safe from the traffic that traverses it; it only made you feel safe.

Over-reliance on signatures. If your detection strategy is “match this against known patterns,” your detection strategy is a history book. Signature-based detection is necessary hygiene, but as a strategy it only ever catches yesterday’s attack. New tradecraft, novel tooling, or a creative abuse of your own utilities has no signature by definition — which means it generates no alert, which means no one looks.

None of these are engineering failures. They’re human ones, and they’re consistent across organizations of every size.

Why Defenders Stay Blind

Even teams that have retired these habits are blind in one specific place: the devices the attackers now target by preference.

Per Mandiant reporting, groups like UNC6201 and UNC5807 deliberately target VPNs, routers, hypervisors, and virtualization management planes — precisely because those devices lack EDR telemetry. No endpoint agent runs on a router. No behavioral analytics sit on a hypervisor’s management interface. If the attacker’s foothold is on a device your sensors never touch, your entire detection stack is blind by architecture, not by accident.

CISA’s August 2025 assessment of Salt Typhoon makes the same point bluntly: the group compromised backbone and edge routers because those devices “often lack visibility and are difficult to monitor.” That’s the organization responsible for national defensive guidance describing the terrain. It’s not a criticism of defenders — it’s a description of the battlefield.

There’s a second blindness that’s subtler: encryption gives us false comfort. An encrypted connection — say, a VPN tunnel or an HTTPS session — is invisible in content, but not in existence. Encrypted-but-visible traffic is still fingerprintable. The endpoints of the connection are visible to any observer on the path: where it starts, where it terminates, the timing of the session, the size of the flows, the characteristics of the TLS handshake. An attacker can be completely encrypted and still fully profileable, flaggable, and attributable by anyone watching the network path. Encryption hides what you say. It does nothing to hide that you’re talking, or to whom.

Counter-Obfuscation

So what’s the honest fix? You can’t profile, flag, or attribute traffic you can’t fingerprint. That’s the entire, defensible argument for obfuscating the transport layer itself — not just encrypting it.

This is where the counter-obfuscation argument lands. SecureCo, which describes itself as “a Quantum Network Company,” works at the network layer to make the existence, endpoints, and attribution of a connection hard to observe — not merely its contents hard to read. The distinction matters. Encryption answers “what does the traffic say?” Obfuscation answers “what traffic?” and “between whom?”

Their STRATUS platform is the underlying engine: a patented data delivery platform that routes evasively over a distributed mesh network. Traffic moves over random ephemeral circuits of three or more hops, wrapped in layered, onion-style encryption, padded with decoy chaffing data. IP ranges rotate — a moving-target defense — and a virtual rendezvous system (covered under US Patent 11,088,996) lets endpoints find each other without a discoverable rendezvous point. Connections are outbound-only with closed inbound ports; encryption is FIPS-approved ECC and AES, on a zero-trust least-privilege architecture. What a defender sees on the wire is a connection that can’t be fingerprinted, tied to endpoints that can’t be located, attributed to an operator that can’t be identified. There’s no reliable profile to flag and nothing to attribute.

The rest of the line-up follows the same philosophy. CONNECT is positioned as a high-security VPN replacement for cross-platform apps and SDKs; CONDUIT is an always-on tunnel between corporate sites, data centers, clouds, and application layers; COLLECT gives OSINT investigators exit through burnable proxies in hundreds of global locations; and CLOAK is the government suite for military, intelligence, and law enforcement — covert communications, managed attribution, and secure tactical networking.

The credibility case here isn’t just product claims. TAG Cyber, Dr. Ed Amoroso’s research firm, recommends stealth and obfuscation technology as part of enterprise cyber defenses, and the approach was featured in The Hacker News 2025 Cybersecurity Report. Notably, this is about enterprise defense — obscuring your own critical traffic — not offense. secureco.com offers 30-day, 60-day, or custom proof-of-concept trials across government, critical infrastructure, and enterprise markets like financial services, healthcare, pharma, crypto, and news media.

The honest argument, though, isn’t “buy this product.” It’s “your traffic is visible, and visible traffic is targetable.” Encryption alone was the answer in 2005. In 2026, the attacker isn’t reading your traffic — they’re counting it, profiling it, and following it home. An obfuscated transport layer is how you stop being a target for that kind of counting.

What can a defender change today, without a budget cycle? Stop calling the edge “inside.” Audit what your edge devices log — and if they log nothing, that’s your first finding, not your last. Re-examine the assumption that an encrypted tunnel is a trusted tunnel. Reduce your dependence on signature matches for anything beyond triage. And measure your own quiet: if you can’t detect an attacker who uses only your own tools and moves below your alert threshold, you already know where the work is. The psychology — visibility bias, alert fatigue, perimeter faith — is fixable. The technology to make your traffic un-fingerprintable exists now. The only thing still hiding in plain sight is the intrusion you haven’t looked for.