--- title: The Smash-and-Grab Era | daily.dev description: An offensive-security veteran traces three eras of cyberattack tradecraft: patient, low-and-slow state espionage (e.g., Titan Rain, Volt Typhoon), loud... canonical: https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Smash-and-Grab Era | daily.dev og:description: An offensive-security veteran traces three eras of cyberattack tradecraft: patient, low-and-slow state espionage (e.g., Titan Rain, Volt Typhoon), loud... og:url: https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v og:image: https://api.daily.dev/og/posts/t8WlcXS8V.png og:image:alt: The Smash-and-Grab Era og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Smash-and-Grab Era **[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 6 min read · 0 upvotes · 0 comments ## Summary An offensive-security veteran traces three eras of cyberattack tradecraft: patient, low-and-slow state espionage (e.g., Titan Rain, Volt Typhoon), loud ransomware extortion with negotiation and regulatory pressure (e.g., ALPHV/BlackCat's SEC complaint against MeridianLink), and now an emerging 'smash-and-grab' era driven by LLMs. The argument is that LLMs remove the two constraints that historically slowed attackers down — needing to understand the environment and moving step-by-step — leaving only inference speed as the limiter. Ransomware dwell time already fell from 4.5 days to under 24 hours before AI, and Google's Threat Intelligence Group documented APT28's PROMPTSTEAL malware querying an LLM live for commands, a pattern called LLM-as-C2. The author warns this enables parallel, multi-path attacks that break detection-and-response models, since defenders can't triage multiple simultaneous threads fast enough, though he admits uncertainty about what defenders should do in response. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is LLM-as-C2 and has it been observed in real malware attacks? LLM-as-C2 describes malware that relays context from a compromised network back to a large language model and asks it what command to run next, rather than hard-coding its logic. Google's Threat Intelligence Group documented the first live example in 2025 with APT28's PROMPTSTEAL, malware that generates its commands on the fly by querying an LLM during an active operation. _Security teams tracking AI-enabled malware tactics like this follow threat intelligence updates on daily.dev._ ### How much has ransomware dwell time decreased in recent years? Median ransomware dwell time fell from 4.5 days to under 24 hours within a single year, according to Secureworks research, with some deployments occurring within just five hours of initial access. This collapse in attacker timelines was already underway before AI tools entered the picture, driven by improved tradecraft and automation rather than LLMs alone. _Incident responders benchmarking detection speed against shrinking dwell times can follow this research on daily.dev._ ## Similar posts on daily.dev - [Schneier on Security](https://daily.dev/posts/schneier-on-security-yuu0xtx3i) · Schneier on Security · 0 upvotes · 0 comments - [Every Ransomware Attack Has a Backstory](https://daily.dev/posts/every-ransomware-attack-has-a-backstory-bzo7w3b2j) · Huntress Blog · 0 upvotes · 0 comments - [Faster attacks and ‘recovery denial’ ransomware reshape threat landscape](https://daily.dev/posts/faster-attacks-and-recovery-denial-ransomware-reshape-threat-landscape-7uwla6t2o) · CSO Online · 0 upvotes · 0 comments - [The Promptware Kill Chain](https://daily.dev/posts/the-promptware-kill-chain-cnydqhwl5) · Security Boulevard · 0 upvotes · 0 comments - [Ongoing Targeted Campaign Against US Law Firms](https://daily.dev/posts/ongoing-targeted-campaign-against-us-law-firms-r3ufz8uzn) · Google Cloud · 0 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Smash-and-Grab Era","url":"https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v"},"datePublished":"2026-08-23T12:22:41.955Z","dateModified":"2026-08-23T12:51:27.478Z","description":"An offensive-security veteran traces three eras of cyberattack tradecraft: patient, low-and-slow state espionage (e.g., Titan Rain, Volt Typhoon), loud...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/86685249ce889311f561038769ec96cb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/86685249ce889311f561038769ec96cb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Sliver C2 Documentation","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sliver C2 Documentation","logo":"https://media.daily.dev/image/upload/logos/placeholder.jpg","url":"https://daily.dev/sources/bishopfox"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"llm,ransomware","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sliver C2 Documentation","item":"https://daily.dev/sources/bishopfox"},{"@type":"ListItem","position":3,"name":"The Smash-and-Grab Era"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v#faq","mainEntity":[{"@type":"Question","name":"What is LLM-as-C2 and has it been observed in real malware attacks?","acceptedAnswer":{"@type":"Answer","text":"LLM-as-C2 describes malware that relays context from a compromised network back to a large language model and asks it what command to run next, rather than hard-coding its logic. Google's Threat Intelligence Group documented the first live example in 2025 with APT28's PROMPTSTEAL, malware that generates its commands on the fly by querying an LLM during an active operation. Security teams tracking AI-enabled malware tactics like this follow threat intelligence updates on daily.dev."}},{"@type":"Question","name":"How much has ransomware dwell time decreased in recent years?","acceptedAnswer":{"@type":"Answer","text":"Median ransomware dwell time fell from 4.5 days to under 24 hours within a single year, according to Secureworks research, with some deployments occurring within just five hours of initial access. This collapse in attacker timelines was already underway before AI tools entered the picture, driven by improved tradecraft and automation rather than LLMs alone. Incident responders benchmarking detection speed against shrinking dwell times can follow this research on daily.dev."}}]} ```