Defenders love a clean kill chain. Initial access, execution, persistence, lateral movement: those are the phases the dashboards light up for. The earlier phases, the quiet ones where someone is reading your API documentation or registering domains that almost look like yours, get filed as “noise” or “nothing actionable yet.” That filing decision is where most cybersecurity programs lose the engagement before it starts.

This week made the case in three different ways. SANS Internet Storm Center reported sustained scans for swagger.json files, with attackers building maps of enterprise web services before throwing a payload. Malwarebytes published research on a fake-invoice campaign caught while the criminals were still building the back end. And Kaspersky documented Argamal, a RAT seeded into pirated hentai games, infecting people on the home devices they later use for hybrid work.

None of these stories share a CVE. They share a structure: visible attacker behavior that arrives before the part most teams actually monitor.

The Quiet Phase Is The Loudest One You’re Missing

Take the swagger.json scans. ISC’s Johannes Ullrich noted that attackers are sweeping the public internet for OpenAPI and SOAP documentation that developers committed without realizing it would be indexed. A swagger file gives you the routes, the parameter shapes, the authentication scheme, and often the version of the framework behind it. For an attacker, it’s the difference between guessing and reading the manual.

Your web application firewall will not alert on this. The requests look like polite GET traffic to documentation endpoints. By the time the attacker comes back with a parameter-tampering payload, they already know the request signature will pass content-type validation. The detection moment that mattered was the one you treated as benign.

The same pattern shows up in BGP. Cloudflare’s First AS enforcement work, also published this week, is about catching forged AS_PATHs at ingress. The hijack itself is an attack; the prefix-leak preparation is recon. Most operators have no telemetry on either until traffic starts going the wrong direction.

Your Threat Intel Caught This Before The Payload Existed

The Malwarebytes fake-invoice writeup is the optimistic version of the same lesson. Their threat intel team found the campaign while the operators were still scaffolding it: half-built templates impersonating Amazon and PayPal, phone-number capture flows being tested, lure copy still in draft. That kind of find depends on monitoring the infrastructure side of the attack lifecycle: newly registered lookalike domains, public test environments, callback infrastructure being warmed up.

If your security program treats threat intelligence as a feed of indicators you ingest after an incident, you are buying the worst version of the product. The valuable artifact is the early-warning relationship between infrastructure signals and your specific attack surface. When a domain that spoofs your invoicing partner gets registered, that’s a controllable event. The phishing emails that arrive two weeks later are not.

What “early” actually looks like

Concretely, the pre-attack window for most enterprises spans four observable channels:

1. Public asset enumeration: scans for documentation endpoints, dev subdomains, exposed .git, .env, swagger files, and GraphQL introspection.
2. Infrastructure preparation: lookalike domain registration, certificate transparency hits, fresh ASNs hosting your brand assets.
3. Identity reconnaissance: LinkedIn scraping of finance and IT staff, password-spray probes from residential proxies, brute-force attempts against legacy auth endpoints.
4. Off-corp infection: malware on personal devices that later VPN, sync, or paste credentials into corporate systems. The Argamal hentai-games case is the textbook example.

Most teams have partial coverage on one or two of these. Almost no one runs all four with named owners.

The Home Device Is The New Pre-Attack Surface

Argamal deserves its own callout. Kaspersky’s analysis describes a remote access trojan distributed inside pirated adult games, sitting quietly on home machines, with full keylog and screen-capture capability. The corporate angle is uncomfortable but real. The person who installs that game is sometimes the same person who later signs into Okta from the same household network, pastes a one-time code into a remote-desktop session, or syncs browser passwords across devices.

Your endpoint detection program does not touch this device. Your DLP does not see what gets typed on it. The signal that exists lives on the identity plane: improbable-travel triggers, browser-fingerprint changes, session anomalies at login. Treating those as “informational” because they didn’t fire alongside a malware alert is exactly the failure mode that produces a 90-day dwell time.

Your Cybersecurity Stack Needs A Pre-Attack Layer

If you accept that recon, infrastructure prep, and off-corp compromise are real attack phases, your defense in depth needs to extend leftward. Here is a tool-agnostic plan that maps to the four channels above.

1. Inventory and remove publicly exposed API documentation. Run a quarterly external scan for swagger.json, openapi.json, /v1/api-docs, and GraphQL introspection on every domain you own. If a doc must be public, ensure it does not reveal internal versioning or hidden routes.
2. Subscribe to certificate transparency feeds for your brand and supplier names. Alert on registration of domains within two Levenshtein edits of yours, and treat new wildcard certs on your domains as a security-team event.
3. Instrument your authentication surface for brute-force and credential-stuffing patterns. Distinct-username velocity, residential-proxy ASNs, and impossible-travel sequences should generate tickets, not dashboard widgets. Pair this with adaptive lockouts and progressive MFA challenges as core threat-protection controls.
4. Treat identity anomalies from unmanaged devices as Tier 1 signals. New device fingerprint plus password change plus OAuth grant inside a 24-hour window is a graphable composite that any modern SIEM can score.
5. Reduce the blast radius of any single compromise through aggressive session timeouts, short-lived tokens, and east-west segmentation. Security hardening at the network boundary does not help when the attacker is already authenticated; segmentation does.
6. Rehearse incident response for the pre-impact phase. Tabletop a scenario where threat intel reports a lookalike domain targeting your finance team three days before any phishing email arrives. Who acts? What is the decision tree? If the answer is “wait and see,” that is the gap.

The posture change is small but real: success on threat detection now includes how often you intervene before an alert fires, with response speed as a secondary metric rather than the headline one.

Frequently Asked Questions

Is removing public swagger documentation worth the developer friction?

For internal-facing APIs, yes. Publish the spec to an authenticated portal instead. For genuinely public APIs, keep the doc but strip internal version strings, hidden routes, and example payloads with realistic identifiers. The goal is removing free recon, not breaking developer experience.

How do small teams without dedicated threat intel staff get the pre-attack signal?

Free certificate transparency monitors, free passive DNS services, and your own authentication logs cover most of it. The work is less about tooling spend and more about assigning a named owner to triage those feeds weekly and feed findings into firewall, identity, and email-gateway controls.

Does this mean traditional incident response playbooks are obsolete?

No. Post-compromise IR still has to be sharp. Adding pre-impact playbooks extends the window in which your team can act, and it usually reduces the severity of the incidents that do reach the post-compromise stage.

Sources

• Continuing Scans for swagger.json – SANS Internet Storm Center
• We found this fake-invoice campaign while scammers were still building it – Malwarebytes
• Argamal: Malware hidden in hentai games – Securelist
• Enforcing the First AS in BGP AS_PATHs – Cloudflare