Attackers spend weeks inside a small accounting firm's email before a single message asks for anything. Here is what they extract during that window (tax returns, financial statements, payroll data), how they extract it, and why the industry's 'MFA and backups' response misses the entire attack.
Read the briefing