Can an attacker stay inside a network for years without being noticed?

Yes. In joint advisory AA24-038A of 7 February 2024, CISA, the NSA and the FBI reported that Volt Typhoon actors had kept access to some victims' IT environments for at least five years. Attackers who use the same administration tools as your IT team leave few signatures behind, which is why behaviour on the network matters.

This answer also appears, with more context, here: Is someone inside your network?

← All 35 questions on Have I been hacked?All topics