John Z Black

John Z Black Mar 20, 2026 Threat Intelligence #byovd #edr-evasion #phishing #botnets #threat-operations #malware-economics

The biggest shift in 2026 is not one flashy technique. It is integration.

Phishing creates access. BYOVD-style EDR suppression extends dwell time. Reused infrastructure keeps costs down. Botnet operators adapt quickly after disruption.

This is why single-team defense keeps falling behind. Attackers are running a pipeline while many defenders still run silos.

Federal takedowns matter, but they are friction events, not finish lines. The right question after every disruption is simple: what is the attacker’s cheapest rebuild path?

Defenders need the same systems mindset. Correlate mail, identity, endpoint, and network telemetry. Tune controls to current lure patterns. Hunt for adaptation, not just known indicators.

You do not win this cycle with one better tool. You win by linking teams and decisions faster than adversaries can reassemble.

Read the full attacker operations-stack analysis