An intrusion campaign is a coordinated effort to break into a target environment and keep access long enough to achieve an objective, such as espionage, data theft, or ransomware deployment. It usually combines several steps: reconnaissance, phishing, credential abuse, lateral movement, persistence, and exfiltration or sabotage. The campaign may involve one operator or a larger team, but the key idea is sustained, organized activity rather than a single isolated login attempt.
This term matters because defenders need to look for patterns across multiple events, not just one alert. In real attacks, an intrusion campaign often leaves traces such as repeated access from unusual locations, changes in account behavior, new remote tools, or fast changes in attacker tactics. Security teams respond by correlating logs, hunting for persistence, limiting privilege, and watching for abnormal workflow changes that suggest an active foothold.