Attackers are handing off access in 22 seconds, Mandiant finds