Threat video1:00
Negative Time-to-Exploit, 60-Day Gap: Detection & IOCs
Exploits now beat patches: mean time-to-exploit hit -7 days in 2025 against 55-61 day remediation. 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for Negative Time-to-Exploit, 60-Day Gap: Detection & IOCs →
Chapters
- 0:00The hookExploits now precede disclosure: roughly -7 days.
- 0:04The storyBacklog exceeded 27,000 unanalyzed CVEs.
- 0:12Attack pathPer ProjectDiscovery, trojanized npm packages with preinstall scripts.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise7 indicators to hunt: 3 file names, 3 paths and 1 package name.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from resource development to impact.
- 0:42Remediation4 steps now: Prioritize remediation by exploitation evidence rather than CVSS or NVD.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Exploits now precede disclosure: roughly -7 days.
0:05Backlog exceeded 27,000 unanalyzed CVEs.
0:09Remediation time stays about 60 days.
0:12Per ProjectDiscovery, trojanized npm packages with preinstall scripts.
0:18Code executed under Bun runtime.
0:20Session state hooked to cloud services.
0:23170 packages compromised in resurgent attacks.
0:28No threat actor is attributed. Confidence: low.
0:337 indicators to hunt: 3 file names, 3 paths and 1 package name.
0:3813 ATT&CK techniques, from resource development to impact.
0:434 steps now: Prioritize remediation by exploitation evidence rather than CVSS or NVD.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.