By David Rodgers, VP of Cybersecurity Solutions
Before joining Ocient, I spent most of my career on the defending side: running security infrastructure operations at a large US bank and, before that, architecting a managed security program at a major carrier. Nation-state actors gave me more than a few chances to adapt my own tradecraft, and one gap showed up in almost every investigation. We couldn’t fully trust the network flow data the organization had paid to capture and store, and we couldn’t get the return on that investment when it mattered most.
The reasons were familiar. Collecting everything wasn’t “technically feasible,” which usually meant it would cost too much or degrade core services — at least until someone fixed those limits. So flows were filtered at the source, exported over UDP with no confirmation they ever arrived (by design), and the network platforms put user services ahead of flow collection. Every customer and enterprise I’ve worked with had flow collection in its service catalog. Unfortunately, very little of that data held up during analysis, and the gaps and inconsistencies tended to surface in the middle of an investigation.
Flow is one example of a broader pattern. In the state-linked campaigns that have done the most damage over the past few years, two things kept the intrusions hidden: the activity looked legitimate, and by the time anyone had a reason to look, the evidence had aged out or had only ever been kept in sampled form.
Below, I walk through a handful of publicly documented campaigns, explain why I think the common thread is a data problem, and describe where the OcientAIQ™ Unified Data Platform fits. I’ll also be clear about where it doesn’t. OcientAIQ isn’t an endpoint agent, an identity provider or a preventive control, and I’d rather say that up front.
How these actors evade detection and hide in networks
The campaigns below are drawn from government advisories and established threat-intelligence reporting. Each illustrates a different way attackers hide their activity by exploiting the controls defenders rely on.
How Volt Typhoon stayed undetected for years: living off the land
US and allied agencies assess that Volt Typhoon, a PRC state-sponsored actor, is pre-positioning inside critical infrastructure networks. It works almost entirely with tools built into the operating system, so there’s very little for a signature to match: the commands are the same ones administrators run every day. CISA says the group held access to some environments for at least five years (CISA AA24-038A).
How APT28 and APT41 hid command-and-control in cloud services you already trust
ESET reported in March 2026 that APT28’s current toolkit pairs two implants, each talking to its operators through a different consumer cloud storage service, Icedrive for one and Filen for the other (ESET, 2026). In a campaign Google documented in 2024, APT41 ran command-and-control through infrastructure behind Cloudflare and through Cloudflare Workers, then exfiltrated data to OneDrive (Google Threat Intelligence, 2024). When the destination is a reputable domain and the session is encrypted, reputation scoring and content inspection have almost nothing to work with.
Why Storm-0558’s forged tokens were so hard to detect: valid tokens, no malware
Storm-0558 used a stolen Microsoft signing key to forge authentication tokens and read cloud mailboxes at roughly two dozen organizations, including US federal agencies. Every access was cryptographically valid, and no malicious file ever crossed the network. The State Department caught it using a mailbox-access audit log that, at the time, came only with a premium license tier (DHS Cyber Safety Review Board).
How SolarWinds SUNBURST evaded detection for nine months: blending into vendor telemetry
SUNBURST ran its first-stage command-and-control over DNS, to subdomains it generated algorithmically. Its later traffic was disguised as the Orion product’s own telemetry protocol. It waited about two weeks before its first check-in and went undetected for roughly nine months, surfacing only because FireEye was investigating a breach of its own network (Mandiant; CISA AA20-352A).
How Salt Typhoon stayed undetected for years: hiding in carrier-scale volume
Salt Typhoon compromised core telecom and ISP networks and operated from backbone and edge routers. CISA and its partners describe the actors moving data over existing peering connections and through high-traffic nodes such as proxies and NAT pools, often inside GRE or IPsec tunnels (CISA AA25-239A). Cisco Talos documented access lasting more than three years in at least one environment (Cisco Talos).
What data architecture catches nation-state actors who live off the land or forge tokens?
Different as these campaigns are, two properties sit underneath every one of them, and they point directly at what a defense actually has to do.
The first property is that the individual event looks legitimate. Living-off-the-land activity resembles administration. Cloud-based command-and-control resembles ordinary software-as-a-service usage. A forged token resembles a real authenticated session. Backbone activity is buried in backbone volume. Because no single event is suspicious on its own, nothing is caught by inspecting events one at a time. The information that distinguishes malicious intent from benign action lives in the pattern across many events, across different sources, and across time, which means a defender can only find it by keeping all the relevant records and analyzing them together.
The second property is that the intrusion lasts longer than the defender keeps its evidence. Reported dwell times in these cases run from months to several years, against a common practice in which the searchable window is measured in weeks. Mandiant reports a global median dwell time of 11 days in its 2025 report and 14 days in 2026 (M-Trends 2025; M-Trends 2026), but median dwell understates the investigative task, which is to establish when an intrusion began and how far it reached. By the time indicators are published, the telemetry needed to answer that has usually been aged out or was only ever captured in sampled form. We looked at what the published data says in Retention math: What published data says about dwell time and log retention.
The federal baseline moved this year as well. In May, OMB Memorandum M-26-14 replaced M-21-31, the logging directive written after SolarWinds. The new floor is six months of searchable data plus twelve months of retrievable data that can sit in lower-cost storage and be rehydrated for an investigation (OMB M-26-14). The table adds one more case, BRICKSTORM, a China-nexus espionage backdoor that Mandiant found on network appliances that don’t support EDR tools. Its average dwell time was 393 days, often long enough that the evidence of the initial intrusion had aged out of the victim’s logs (Google Threat Intelligence, 2025).
Here’s how the campaigns line up against those windows.
Four of the five outlasted both a 90-day window and the new federal searchable floor. SUNBURST, the intrusion that led to M-21-31, would sit outside the searchable window of the memo that replaced it, reachable only through a restore. Storm-0558 fit every window, but most of its victims still couldn’t have seen it because they weren’t collecting the log that exposed it. Retention depth and completeness of collection are separate requirements, and you need both.
Both properties belong to the data platform under the security program. The first is answered by complete collection and correlation across data types; the second, by how far back you can search. Detection rules run on whatever that platform kept, and I think the platform gets far less scrutiny than the rules do.
Where OcientAIQ Fits: Hunting and incident response
A data platform does not stop an intrusion. What it can do is take both of those properties away from the attacker, through hunting and through incident response.
Hunting for activity that looks legitimate
When command-and-control runs to a trusted destination over an encrypted session, what’s left is behavior: a host reaching a cloud endpoint on a steady cadence, an administrative protocol appearing from a source that has never used it, or a transfer volume well outside that host’s own norm. Timing alone won’t separate good from bad. Operators add jitter to their check-ins, and plenty of legitimate software, update checkers for one, calls home on a schedule. Telling them apart takes enough unsampled history to learn each host’s normal rhythm, the technique discussed in our post, Detecting low-and-slow beaconing with SQL over multi-year flow history. It only works if network, DNS, endpoint, identity and cloud audit records are kept at full resolution and can be queried together.
Mandiant also reports that espionage groups increasingly persist on edge devices that don’t produce standard security telemetry (M-Trends 2026). You can’t install an EDR agent on a VPN concentrator or a core router, but you can still see the traffic they send and pass along, because flow and DNS records capture it on the network.
Several of the campaigns above crossed data boundaries on purpose. SUNBURST began with DNS command-and-control, moved to forging SAML tokens with signing keys stolen from the victim’s own identity server, and ended in cloud-hosted email (CISA AA21-008A). Salt Typhoon moved from compromised edge routers into the systems carriers use for call records and lawful intercept requests (FBI and CISA). When network data lives in one system, identity in a second and cloud audit in a third, the step from one to the next is the hardest thing to see. When they’re joinable tables in one platform, you can correlate across them in SQL and run graph analysis over the same data to trace how an actor got from one segment to the next.
Incident response: Were we exposed before the indicator was published?
Every one of these campaigns eventually produced indicators, whether a coordinator domain, an application ID or a device fingerprint. Each time, defenders had to work out whether they’d been hit, when it started and how far it spread. The Salt Typhoon advisory goes a step further and recommends establishing the full extent of the actor’s access before starting eviction, so the cleanup doesn’t tip them off (CISA AA25-239A). That’s a scoping question. Answering it means searching the whole retained history at full fidelity, quickly, without first rehydrating it from cold storage or paying a per-query price that discourages a large historical scan.
I’d argue this retrospective search is the most valuable thing a data layer contributes to an advanced-threat response, and it’s the one that sampled, short-retention and cold-storage architectures handle worst. It doesn’t have to wait for an analyst, either. A scheduled job can check each new batch of threat intelligence against years of flow and DNS history, so exposure that predates a public indicator surfaces on its own. Our post, Retrospective IOC sweeps: Establishing whether you were ever exposed, walks through that pattern. M-26-14 points the same way: hunting for indicators of compromise and mapping source and destination traffic are two of the eleven outcomes agency logging now must support.
The reason this is an OcientAIQ argument rather than a generic data lake one is that the requirements line up with how these actors work, and the requirements are difficult to meet at the same time. The table that follows lines them up with the documented behavior.
Catching these actors takes a data architecture that holds network, endpoint, identity, and cloud records together at full resolution, keeps them for years rather than weeks, ingests carrier-scale traffic without sampling, answers historical questions interactively at a predictable cost, and runs on premises or air-gapped where the mission requires it.
None of those are detection algorithms. They are the conditions that let detection and response work at all against an adversary built to defeat both, and OcientAIQ is built to meet the combination. That the combination is hard to assemble in one place is much of the reason it remains uncommon.
The last row matters more than it looks: the organizations these actors target most, such as government agencies and large financial institutions, often can’t send security telemetry to a public cloud for analysis, so the platform has to run on premises, in a private cloud or fully air-gapped.
What this does not do
A retention and analytics layer doesn’t prevent an intrusion. It would not have blocked a trojanized signed update, the theft of a signing key, or a login with valid stolen credentials. Prevention belongs to endpoint, identity, and configuration controls, and this layer sits beneath them as the record of what happened.
It is not an endpoint or identity product. A large share of living-off-the-land tradecraft produces little network signal by design, and in those cases host and identity telemetry are the primary evidence. This layer contributes the network-observable portion and the long retention window. OcientAIQ can store and analyze host and identity logs where they are ingested, but it cannot reconstruct data that was never collected.
Its view of encrypted traffic is limited to metadata: who communicated with whom, when, how often, and how much. For this class of adversary, that metadata is frequently enough to establish a pattern, but it is not an inspection of content, and it should not be described as though it were.
Finally, it complements the security operations tooling already in place rather than replacing it. Detections and findings are meant to surface as alerts inside the SIEM or orchestration system the team already uses. What the layer adds is a longer and more complete record for those tools to draw on, not another console to watch.
Where this leaves a defender
The campaigns above point to the same conclusion. A capable actor’s lasting advantages are that its activity looks like normal operations and that it stays longer than you keep evidence. Better detection content helps at the margins; what closes the gap is how complete, how broad, and how deep your data is. All three get harder as volume grows, which is exactly where most architectures start to sample, expire data or price historical analysis out of reach. That’s where OcientAIQ fits, and it’s why I think the data layer belongs in an advanced-threat program alongside the endpoint, identity and preventive controls it’s designed to work with.
If you’re working through retention under M-26-14, or trying to answer “Were we exposed?” faster than your current stack allows, I’d like to compare notes.
Ready to learn more? Contact us.