LevelBlue Q3 Briefing: Trusted Access Fueled Data Theft
Summary
LevelBlue’s Q3 2026 incident-response briefing reports data exfiltration in 83% of intrusion cases, phishing as the leading initial-access vector (42%), and MFA bypass in 79% of BEC incidents where MFA was enabled.
Key points
- The briefing draws on LevelBlue incident-response investigations worldwide and describes its findings as technology-agnostic.
- LevelBlue observed data exfiltration in 83% of intrusion cases, compared with encryption in 67%; exfiltration overtook viewing or accessing files as the most common outcome when data was at risk.
- Business email compromise accounted for 32% of incidents, non-ransomware network intrusions for 22%, and ransomware for 20%.
- Phishing was the leading initial-access vector at 42%; external remote services and exploited vulnerabilities each accounted for 14%.
- Attackers bypassed MFA in 79% of BEC incidents where it was enabled; the briefing describes vishing and enrollment of attacker-controlled devices as observed methods.
- The report describes incidents involving Metabase CVE-2026-72898, including attackers creating administrator accounts and using connected AI engines to access third parties and exfiltrate data.
- LevelBlue recommends monitoring large outbound transfers, unusual archive creation, new cloud-storage destinations, session-token use, and device enrollment activity.
Article Details
- Publisher
- LevelBlue SpiderLabs
- Report Period
- Q3 2026
- Scope
- Technology-agnostic findings from LevelBlue incident response engagements worldwide, supplemented by LevelBlue SpiderLabs threat intelligence.
- Key Statistics
- Data exfiltration appeared in 83% of intrusion cases in Q3 2026; encryption appeared in 67%. The report says both were 77% in Q2.
- Phishing accounted for 42% of initial intrusion vectors in Q3, down from 65% in Q2.
- Threat actors bypassed MFA in 79% of Q3 business email compromise incidents where MFA was enabled.
- Technology & Software accounted for 14% of incidents in Q3, compared with 5% in Q2 and 3% in Q1.
- Among incidents included in the dwell-time measure, 56% were resolved within 0–10 days; MDR clients were excluded.
- Recommendations
- Monitor for large outbound transfers, unusual archive creation, and new cloud storage destinations.
- Inventory internet-facing business applications that touch sensitive data and prioritize them for patching.
- Pair MFA with continuous session-token monitoring, short token lifetimes, and conditional-access policies that flag anomalous token use.
- Use phishing-resistant MFA and strengthen monitoring of enrollment activity and account misuse across cloud and on-premises environments.
- Understand where sensitive information resides, who can access it, and how to detect abnormal movement or exfiltration.
MITRE ATT&CK
T1003.006 · DCSyncThe report names DCSync among the credential-stealing methods used to escalate privileges.T1078 · Valid AccountsThe report describes valid-account abuse and attackers using stolen credentials or tokens to gain access.T1098.005 · Device RegistrationAttackers reportedly enrolled an attacker-controlled device on a victim account, with the victim approving the registration.T1133 · External Remote ServicesExternal remote services, including RDP and VPN, were reported as initial intrusion routes.T1190 · Exploit Public-Facing ApplicationThe report describes attackers exploiting internet-facing vulnerabilities for initial access, including the Metabase vulnerability.T1486 · Data Encrypted for ImpactEncryption was observed in a portion of intrusions, including attacks combining encryption with data exfiltration.T1566 · PhishingPhishing was the most common initial intrusion vector, including phishing kits used to capture session tokens.
CVE
Products
Tools
7-ZipUtilities such as rclone, MegaSync, WinSCP, 7-Zip, and WinRAR continue to play an important role in attacker workflows, helping collect, package, and transfer sensitive information outside the organization.MEGAsyncUtilities such as rclone, MegaSync, WinSCP, 7-Zip, and WinRAR continue to play an important role in attacker workflows, helping collect, package, and transfer sensitive information outside the organization.MeshAgentBack door/remote access tools remain the most common tool type leveraged to gain persistence, using tools like ScreenConnect and MeshAgent to maintain access.MimikatzCredential stealers, like mimikatz and DCSync, continue to be commonly used to escalate privileges, as identity compromise remains a top concern.RCloneUtilities such as rclone, MegaSync, WinSCP, 7-Zip, and WinRAR continue to play an important role in attacker workflows, helping collect, package, and transfer sensitive information outside the organization.ScreenConnectBack door/remote access tools remain the most common tool type leveraged to gain persistence, using tools like ScreenConnect and MeshAgent to maintain access.WinRARUtilities such as rclone, MegaSync, WinSCP, 7-Zip, and WinRAR continue to play an important role in attacker workflows, helping collect, package, and transfer sensitive information outside the organization.WinSCPUtilities such as rclone, MegaSync, WinSCP, 7-Zip, and WinRAR continue to play an important role in attacker workflows, helping collect, package, and transfer sensitive information outside the organization.
Industries
Financial ServicesFinancial services, which had been the top impacted sector for the last few quarters, dropped to #4, accounting for only 11% of incidents in Q3, down from 28%.HealthcareHealthcare and Manufacturing tied for the 2nd spot at 13%.ManufacturingHealthcare and Manufacturing tied for the 2nd spot at 13%.Technology & SoftwareTechnology & Software surged to the top spot, accounting for 14% in Q3, up from 5% in Q2, and 3% in Q1.