The Smash-and-Grab Era
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
An offensive-security veteran traces three eras of cyberattack tradecraft: patient, low-and-slow state espionage (e.g., Titan Rain, Volt Typhoon), loud ransomware extortion with negotiation and regulatory pressure (e.g., ALPHV/BlackCat's SEC complaint against MeridianLink), and now an emerging 'smash-and-grab' era driven by LLMs. The argument is that LLMs remove the two constraints that historically slowed attackers down — needing to understand the environment and moving step-by-step — leaving only inference speed as the limiter. Ransomware dwell time already fell from 4.5 days to under 24 hours before AI, and Google's Threat Intelligence Group documented APT28's PROMPTSTEAL malware querying an LLM live for commands, a pattern called LLM-as-C2. The author warns this enables parallel, multi-path attacks that break detection-and-response models, since defenders can't triage multiple simultaneous threads fast enough, though he admits uncertainty about what defenders should do in response.
Table of contents
The First Era: Low and SlowThe Second Era: Loud is the PointThe Third Era: Smash and GrabSo, What Changes?Questions this post answers
What is LLM-as-C2 and has it been observed in real malware attacks?
LLM-as-C2 describes malware that relays context from a compromised network back to a large language model and asks it what command to run next, rather than hard-coding its logic. Google's Threat Intelligence Group documented the first live example in 2025 with APT28's PROMPTSTEAL, malware that generates its commands on the fly by querying an LLM during an active operation. Security teams tracking AI-enabled malware tactics like this follow threat intelligence updates on daily.dev.
How much has ransomware dwell time decreased in recent years?
Median ransomware dwell time fell from 4.5 days to under 24 hours within a single year, according to Secureworks research, with some deployments occurring within just five hours of initial access. This collapse in attacker timelines was already underway before AI tools entered the picture, driven by improved tradecraft and automation rather than LLMs alone. Incident responders benchmarking detection speed against shrinking dwell times can follow this research on daily.dev.