---
title: "The Smash-and-Grab Era"
url: https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v
source_url: https://bishopfox.com/blog/the-smash-and-grab-era
type: article
source: "Sliver C2 Documentation"
published: 2026-08-23T12:22:41.955Z
updated: 2026-08-23T12:51:27.478Z
tags: ["llm", "ransomware"]
reading_time: 6
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# The Smash-and-Grab Era

**[Sliver C2 Documentation](https://daily.dev/sources/bishopfox)** · 6 min read · 0 upvotes · 0 comments

## Summary

An offensive-security veteran traces three eras of cyberattack tradecraft: patient, low-and-slow state espionage (e.g., Titan Rain, Volt Typhoon), loud ransomware extortion with negotiation and regulatory pressure (e.g., ALPHV/BlackCat's SEC complaint against MeridianLink), and now an emerging 'smash-and-grab' era driven by LLMs. The argument is that LLMs remove the two constraints that historically slowed attackers down — needing to understand the environment and moving step-by-step — leaving only inference speed as the limiter. Ransomware dwell time already fell from 4.5 days to under 24 hours before AI, and Google's Threat Intelligence Group documented APT28's PROMPTSTEAL malware querying an LLM live for commands, a pattern called LLM-as-C2. The author warns this enables parallel, multi-path attacks that break detection-and-response models, since defenders can't triage multiple simultaneous threads fast enough, though he admits uncertainty about what defenders should do in response.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://bishopfox.com/blog/the-smash-and-grab-era>

## Questions this post answers

### What is LLM-as-C2 and has it been observed in real malware attacks?

LLM-as-C2 describes malware that relays context from a compromised network back to a large language model and asks it what command to run next, rather than hard-coding its logic. Google's Threat Intelligence Group documented the first live example in 2025 with APT28's PROMPTSTEAL, malware that generates its commands on the fly by querying an LLM during an active operation.

_Security teams tracking AI-enabled malware tactics like this follow threat intelligence updates on daily.dev._

### How much has ransomware dwell time decreased in recent years?

Median ransomware dwell time fell from 4.5 days to under 24 hours within a single year, according to Secureworks research, with some deployments occurring within just five hours of initial access. This collapse in attacker timelines was already underway before AI tools entered the picture, driven by improved tradecraft and automation rather than LLMs alone.

_Incident responders benchmarking detection speed against shrinking dwell times can follow this research on daily.dev._

## Similar posts on daily.dev

- [Schneier on Security](https://daily.dev/posts/schneier-on-security-yuu0xtx3i) · Schneier on Security · 0 upvotes · 0 comments
- [Faster attacks and ‘recovery denial’ ransomware reshape threat landscape](https://daily.dev/posts/faster-attacks-and-recovery-denial-ransomware-reshape-threat-landscape-7uwla6t2o) · CSO Online · 0 upvotes · 0 comments

---

Tags: [#llm](https://daily.dev/tags/llm), [#ransomware](https://daily.dev/tags/ransomware)

[View this post on daily.dev](https://daily.dev/posts/the-smash-and-grab-era-t8wlcxs8v)