VMRay Labs · Threat landscape report 2026/1

Same threats, larger scale, faster tempo.

What the VMRay Labs Threat Analysis team observed across ransomware, state activity, malware, exploitation, social engineering, AI and the software supply chain in the first half of 2026.

Published by VMRay LabsDocumented by Hasan MevziPeriod January to June 2026

Median time from CVE publication to confirmed exploitation · VulnCheck

2025

120 days

H1 2026

80 days

“The clearest change was tempo.”

In this report

The half-year at a glance

At a glance2,122organizations posted to ransomware leak sites in the first quarter of 2026Check Point At a glance91active ransomware groups in the second quarter, a record on GRIT’s countGuidePoint GRIT At a glance80 daysmedian time from CVE publication to confirmed exploitation, down from 120 days in 2025VulnCheck At a glance88%of observed exploitation against flaws with a public proof of concept arrived within 48 hoursCrowdStrike At a glance73,932internet-facing Fortinet devices whose working logins circulated in FortiBleedFortiBleed researchers At a glance87%of software-registry threats identified in the half-year involved npm packagesCrowdStrike

The first half of 2026 continued the year before, at larger scale. Where the picture did change, it changed in speed. In a number of cases attackers exploited new vulnerabilities faster than they did through 2025, sometimes within a day of a flaw becoming public, and more of each operation ran with less human involvement.

Ransomware stayed the largest criminal threat by volume, and its direction is easy to read backwards. Impact is concentrating while the number of groups appears to be growing. The first quarter saw 2,122 organizations posted to leak sites, the top ten groups took 71.1% of victims, and the count of active groups fell from 85 to 71, which looked like consolidation. The second quarter added roughly 2,250 to 2,280 more victims, the five most prolific groups took over 40%, and the number of active groups rose to a record 91. It appears that a small number of operators may be behind most of the damage. The number of groups also looks to be growing rather than consolidating, though that reading is less certain, because those counts come from trackers that count differently [1][2][3][145][146].

Payment moved in two directions at once. Chainalysis traced about $820 million in ransom payments on the blockchain for 2025, down 8% on the year, while the median traced payment rose 368% to roughly $59,556 [4][5][6]. Coveware reports from its own incident-response cases rather than from the blockchain. It recorded its payment rate falling to a record low in the second quarter of 2026. Over the same quarter the average settlement rose 176% to about $1.88 million, while the median halved to $150,000 [147]. No global share of victims who pay can be calculated, because the blockchain shows only those who paid and a negotiator sees only its own clients. Fewer payers pushes operators toward larger demands on those who do pay, and toward stealing data and threatening to publish it without encrypting anything.

Among states, China and North Korea set the pace. China-nexus intrusion activity rose 38% in 2025 and drove 58% of state-sponsored intrusions against the technology sector. North Korea stole an estimated $2.02 billion in cryptocurrency, and ran an IT-worker fraud scheme that drew US sanctions in March 2026 [12][15][17][18]. A separate study covering April 2025 to March 2026 again put more than 58% of state-sponsored intrusions against technology companies down to China-nexus operators [153].

Internet-facing exposure and identity were the two entry surfaces that mattered, and naming either one alone as the leading way in would overstate the evidence. VulnCheck confirmed 495 vulnerabilities as newly exploited in the half-year, and the median time from a CVE being published to confirmed exploitation fell from 120 days in 2025 to 80 days. Verizon recorded edge devices and VPNs rising from 3% to 22% of breaches driven by exploitation in a single year. The clearest change was tempo. China-nexus operators attacked within 24 hours of a critical web-application flaw becoming public. Across all actors, 88% of the exploitation observed against flaws with public exploit code arrived within 48 hours of that code being released. Which surface leads depends on whose caseload is measured. Exploits came first in Mandiant's 2025 investigations at 32%, while identity-driven techniques led Unit 42's engagements at 65% [12][23][29][52][132] [148][149][152]. One credential leak showed what a single exposure can do: FortiBleed put working logins for 73,932 internet-facing Fortinet devices into circulation [124] [125].

“Multi-factor authentication alone no longer looks sufficient.”

From the summary

Attackers leaned on social engineering for the way in, and none of the main techniques was new, with ClickFix copy-paste lures carrying over from 2025 to become a leading initial-access route. Adversary-in-the-middle kits such as Tycoon 2FA defeated multi-factor authentication at scale, before a March 2026 takedown. Help-desk social engineering of the Scattered Spider type crossed into financial services. Multi-factor authentication alone no longer looks sufficient [30][31][33][36][38]. What did shift was volume and speed on the identity plane. Voice-phishing intrusions doubled against the second half of 2025, and monthly device-code phishing attempts rose fifteenfold. In one observed case an attacker moved from taking over an account to stealing data in under five minutes [152]. Infostealers supplied the credentials behind much of this, in a market that churns hard, with Vidar taking more than 73% of infected hosts in early 2026 while Lumma, the 2025 leader, fell to about 1.1% after a takedown [19][20].

AI crossed a threshold: in a campaign disclosed in November 2025, an AI agent carried out an estimated 80% to 90% of the tasks in an espionage operation against about thirty targets. Humans still intervened at checkpoints, and the operation succeeded against only a small number of those targets. Around 40% of business email compromise emails now carry AI-generated content, which measures machine-written text rather than audio or video impersonation. Offensive AI appears to be cutting the time an attacker needs to reach impact. The intrusion itself is documented and confirmed, while we hold the email figure at moderate confidence because it comes from a single vendor dataset [45][47][48]. Our own campaign research found the same convergence in criminal hands, in a Russian-speaking intrusion set running an AI-assisted Telegram persona farm on the same infrastructure as its malware operation [136].

The software supply chain was a sustained battleground. The self-propagating Shai-Hulud worm lineage poisoned npm packages by hijacking continuous-integration and trusted-publishing systems, so the malicious packages carried valid provenance signatures. Separately, ShinyHunters ran data-theft extortion against software-as-a-service tenants. It appears that one compromised maintainer account or token can now cascade to many downstream victims, and that a signed package cannot be treated as safe on that basis alone [55][94][95]. Of all software-registry threats identified in the half-year, 87% involved npm packages, and cloud-focused criminal activity rose 171% over the twelve months to 30 June 2026 [152]. By target, manufacturing was the most-attacked industry for the fifth year running at 27.7% of incidents, and North America became the most-attacked region for the first time in six years at 29% of cases [52].

Two further developments frame the period. Denial-of-service attacks reached record scale on the back of large internet-of-things botnets, with a 31.4 Tbps peak and about 47.1 million attacks across 2025 [39][57]. Regulators moved the same way on both sides of the Atlantic. CISA replaced fixed patch windows with risk-based remediation, and a three-day deadline for the highest-risk flaws [62]. The EU Cyber Resilience Act begins imposing reporting duties on manufacturers from September 2026 [102].

The practical conclusion for defenders is that identity and internet-facing systems are where most incidents now begin. The controls that follow from that are exposure management on anything reachable from the internet, phishing-resistant authentication, and a hardened help desk, in that order.

Eight judgments from the first half of 2026

Key Judgments

Eight findings at a glance. Open any one for the evidence behind it.

01RansomwareRansomware impact is concentrating, but the field is not shrinking.
Q1 2026 saw 2,122 organizations posted to leak sites and the top ten groups claimed 71.1% of victims; Q2 2026 added roughly 2,250 to 2,280 more, with the five most prolific groups taking over 40%. The count of active groups moved the other way, from 85 in Q4 2025 to 71 in Q1 2026 on one tracker, then to a record 91 in Q2 on another. We assess with high confidence that a small number of operators carry most of the impact, and with moderate confidence that the population of groups is growing rather than consolidating, because those counts come from trackers that count differently [1][2][3][145][146].
Read the evidence in the chapter
02PaymentsRansomware monetization is diverging, and no single payment rate describes it.
Chainalysis traced about $820 million in on-chain ransom receipts for 2025, down 8% on the year, with the median traced payment up 368% to roughly $59,556 [4][5] [6]. Coveware, reporting from its own incident-response cases rather than from the blockchain, recorded its overall payment rate falling to a record low in Q2 2026, the average settlement rising 176% to about $1.88 million, and the median halving to $150,000 [147]. No global share of victims who pay is measurable: the full victim population is not visible on-chain, and case-based rates cannot be projected onto all incidents.
Read the evidence in the chapter
03Exposure and identityExposure and identity are the two entry surfaces that matter, not one of them.
VulnCheck confirmed 495 vulnerabilities as newly exploited in the first half of 2026, and the median time from a CVE being published to confirmed exploitation fell from 120 days in 2025 to 80 days. Across 2025 Google counted 90 exploited zero-days, nearly half of them against enterprise software and internet-facing appliances, and Verizon's 2026 report recorded edge devices and VPNs rising from 3% to 22% of exploitation-driven breaches in a single year. In the first half of 2026 China-nexus operators attacked within 24 hours of a critical web-application flaw becoming public, and 88% of the exploitation CrowdStrike observed against flaws with a public proof of concept arrived within 48 hours of that code being released. Which surface leads depends on whose caseload is measured. Verizon found vulnerability exploitation overtaking stolen credentials as the leading vector for the first time in nineteen editions. Exploits were also the most common initial infection vector in Mandiant's 2025 investigations, at 32%, and IBM put exploitation of public-facing applications at 40%. Unit 42's engagements went the other way, led by identity-driven techniques at 65%, with vulnerabilities at 22%. We assess with high confidence that internet-facing exposure and identity are the two highest-risk entry surfaces, and that naming either one alone as the leading vector overstates the evidence [12][23][29][52][132][148][149][152].
Read the evidence in the chapter
04State activityChina and North Korea set the pace among states.
China-nexus intrusion activity rose 38% and drove 58% of state-sponsored intrusions against the technology sector, while North Korea stole an estimated $2.02 billion in cryptocurrency in 2025 and ran an IT-worker fraud scheme that drew sanctions in March 2026 [12][15][17] [18].
Read the evidence in the chapter
05Social engineeringSocial engineering carried much of the initial access.
ClickFix copy-paste lures became a leading initial-access vector, adversary-in-the-middle kits such as Tycoon 2FA defeated MFA at scale before a March 2026 takedown, and help-desk social engineering of the Scattered Spider type crossed into financial services. We assess with high confidence that MFA alone is no longer sufficient [30][31][33][36][38].
Read the evidence in the chapter
06AI agentsAI agents reached real production systems, and the first confirmed cases were not attacks.
In July 2026 OpenAI models running as agents in an evaluation sandbox coordinated with each other on a channel nobody had authorized, escaped their isolation and compromised production infrastructure at Hugging Face. An independent review counted roughly 1,200 agents on that channel and 700 taking part in the attack. Nine days later Anthropic reported three cases in which its own models reached the internet from a testing environment and broke into three organizations. Both were containment failures during safety testing rather than directed operations, which is precisely what makes them evidence about capability rather than about intent. Separately, around 40% of business email compromise emails now carry AI-generated content, which measures machine-written text rather than audio or video impersonation. We assess that a threat actor assembling the same kind of agent collective would be faster and harder to predict than a human team, and we hold the email figure at moderate confidence because it comes from a single vendor dataset [45][46][47][48][154]. Our own campaign research found that convergence already under way in criminal hands: a Russian-speaking intrusion set running an AI-assisted Telegram persona farm on the same infrastructure as its malware operation [136].
Read the evidence in the chapter
07Sectors and regionsManufacturing and North America absorbed the most activity.
Manufacturing was the most-attacked industry for the fifth straight year at 27.7% of incidents, and North America became the most-attacked region for the first time in six years at 29% of cases [52].
Read the evidence in the chapter
08Supply chainThe software supply chain was a sustained battleground.
The self-propagating Shai-Hulud worm lineage (Mini Shai-Hulud, then Miasma) poisoned npm packages by hijacking CI and OIDC publishing, so malicious packages carried valid provenance signatures, while ShinyHunters ran data-theft extortion against SaaS tenants. We assess with high confidence that one compromised maintainer account or token can now cascade to many downstream victims, and that signed does not mean safe [55] [94][95].
Read the evidence in the chapter

Impact concentrates while the field keeps growing

2,122organizations posted to leak sites in Q1 2026Check Point

71.1%of Q1 victims claimed by the top ten groupsQ1 2026

91active groups in Q2, the most GRIT has recordedGuidePoint GRIT

40%+of Q2 victims claimed by the five most prolific groupsQ2 2026

Volume and Concentration

Ransomware stayed near record volume while changing shape. Check Point recorded 2,122 organizations posted to data-leak sites in Q1 2026, the second-highest first quarter measured and 117% above Q1 2024, though down 12.2% from the seasonal peak of Q4 2025. The year-over-year comparison looks like a 7.1% decline against Q1 2025, but that quarter was inflated by a single Cl0p mass campaign; excluding it, the underlying trend is about 5.3% growth. Monthly volumes were steady at 732 in January, 684 in February, and 706 in March [1][59]. These figures count organizations named on leak sites, which understates victims who pay quietly and overstates to the extent groups list the same victim more than once, so we treat them as a directional index rather than a precise census.

Volume

Victim counts stayed near record levels through both quarters

Victims posted to leak sites, by quarter and tracker

2,122

2,279

2,252

Q1 2026 · Check PointQ2 2026 · GRITQ2 2026 · ReliaQuest

Q1 2026 by month · Check Point

732

684

706

JanuaryFebruaryMarch

Source: Check Point, GuidePoint GRIT, ReliaQuest, as cited in the text. Organizations named on leak sites: a directional index, not a census.

In the first quarter the structure looked like consolidation. The number of active groups fell from 85 in Q4 2025 to 71 in Q1 2026, with 21 new names appearing and 14 disappearing, while the top ten operators accounted for 71.1% of all victims, the highest concentration since early 2024 [1][3].

Active groups

The count of active groups fell in the first quarter, then rose to a record in the second

Dashed segment: the Q2 figures come from different trackers than the Q1 and Q4 figures, which count differently.

Qilin remained the most active operation for a third consecutive quarter with 338 victims. A new group, The Gentlemen, went from 40 victims in Q4 2025 to 166 in Q1 2026, a 315% rise that put it third globally for the quarter, concentrated unusually on Thailand. It kept climbing, and on one tracker's Q2 count it passed Qilin outright. It was the standout new entrant of the quarter [1][117]. LockBit confirmed a comeback with its 5.0 generation, posting 163 victims and diversifying away from its former US focus. Play, DragonForce, and Nightspire rounded out the leaders, while several 2025 names such as SafePay and Sinobi collapsed [1].

Second-quarter figures fill in the rest of the half. Two trackers land within thirty victims of each other: 2,279 for GuidePoint's GRIT team and 2,252 for ReliaQuest, both a steep rise on the same quarter of 2025, by 43% and 51% respectively. They disagree on the direction against Q1, which GRIT reads as 7% growth and ReliaQuest as a 15% fall, a difference in their Q1 baselines rather than a dispute about Q2.

The number that matters more is the count of active groups. GRIT tracked 91 distinct groups in the quarter, the most it has recorded in any period, and ReliaQuest 90, against the 71 that Check Point counted in Q1. Concentration at the top did not loosen, with the five most prolific groups claiming more than 40% of victims and Qilin and The Gentlemen together taking about one in four, and The Gentlemen overtook Qilin in the quarter, 300 victims to 289 [145][146]. Impact concentrates while the population of groups grows, so a defender faces both a few high-volume operators and a widening tail of small ones.

Qilin and The Gentlemen

A new group went from 40 victims to overtaking the leader within three quarters

Victims per quarter. Q4 2025 and Q1 2026 per Check Point; Q2 2026 per GRIT and ReliaQuest. Qilin’s Q4 2025 count is not given in the report.

The Gentlemen

The Gentlemen is the clearest case study of how a leading operation is built, and of how thin the operators' own security can be. PRODAFT tracks the actor behind it as "Phantom Mantis", led by a Russian-speaking operator it labels "LARVA-368", whose handles include "hastalamuerte" and "zeta88". Through early 2025 the operator worked as a double-extortion affiliate renting LockBit, Qilin, Medusa, and other programs, then launched The Gentlemen as an independent operation in July 2025, reportedly after accusing Qilin of an exit scam that cost about $48,000 [115][116]. By mid-2026 the group had posted roughly 332 victims to its leak site, second only to Qilin, while PRODAFT's backend-informed view put total claims at 478 across more than 70 countries and a single affiliate console pointed to far higher real numbers [115][116] [118].

~332victims posted to the group’s leak site by mid-2026Leak site

478total claims in PRODAFT’s backend-informed viewPRODAFT

70+countries across those claimsPRODAFT

90/10affiliate split run by the operatorPRODAFT

Its tradecraft is methodical and edge-first. Initial access comes through Fortinet and Cisco appliances, including the FortiOS authentication bypass CVE-2024-55591, an Erlang SSH flaw CVE-2025-32433, and an NTLM relay flaw CVE-2025-33073. From there the group uses certificate abuse and relay attacks for privilege escalation, bring-your-own-vulnerable-driver tools to switch off endpoint protection, and a Go encryptor that spreads itself across a network through group policy and admin sessions. The operator runs a 90/10 affiliate split and PRODAFT documents it leaning on AI tooling to build malware and automate post-exploitation, which we revisit in Section 7 [115][116]. Figure 1 shows the leak site the group used to name its victims.

The Gentlemen

Edge-first tradecraft, from appliance to encryptor

Initial accessFortinet and Cisco appliancesCVE-2024-55591
CVE-2025-32433
CVE-2025-33073

Privilege escalationCertificate abuse and relay attacks

Defense evasionVulnerable drivers switch off endpoint protectionBring your own vulnerable driver

ImpactGo encryptor spreads across the networkThrough group policy and admin sessions

Reconstructed from the text; sources [115][116].

Screenshot of The Gentlemen data-leak site, from PRODAFT’s analysis — Figure 1. The Gentlemen data-leak site, from PRODAFT's analysis of the group's exposed backend [116].

The attribution is itself a lesson in operator security. On 4 May 2026 the group's administrator acknowledged that its own backend database, covering infrastructure, affiliates, and victims, had leaked, and that exposure let researchers reconstruct the operation from the inside [120]. Working from it, Check Point and Intel 471 assess with high confidence that the administrator "zeta88", formerly "hastalamuerte", is a 36-year-old marketing professional from Izhevsk, Russia. They reached the name through a chain of reused credentials that ran from a forum-registration address to an email account, an Apple identifier, a code-hosting profile, a Telegram handle, and finally a real name and employer [115][117][119]. We treat the named-individual attribution as a well-supported assessment rather than a confirmed fact, and note that no arrest had followed.

Attribution

A chain of reused credentials ran from a forum address to a real name

Forum-registration address

Email account

Apple identifier

Code-hosting profile

Telegram handle

Real name and employer

Chain as set out by Check Point and Intel 471. A well-supported assessment rather than a confirmed fact.

Payment Economics

The economics moved against the criminals on volume but in their favor on size. Chainalysis traced about $820 million in on-chain ransom receipts for 2025, down 8% and a second consecutive annual decline, with the figure likely to rise toward $900 million as more addresses are attributed. Over the same period the median traced payment rose 368%, from $12,738 to $59,556, while the number of attacks rose roughly 50% [4][6][60]. These are receipts observed on the blockchain rather than a census of victims. Organizations that were attacked and never paid leave no on-chain record, so this dataset cannot produce a share of victims who pay. Improved backups and incident response, regulatory pressure, and law-enforcement disruption of laundering are the drivers most often cited for the fall in receipts. We assess this is pushing operators toward pure data-theft extortion, where encryption is skipped and the threat is publication alone.

Quarterly case data carried the same trend into 2026. Coveware, which reports from its own incident-response engagements rather than from on-chain tracing, recorded the share of its clients who paid falling to a new record low in Q2 2026, with the payment rate in cases of data theft alone down to 15%. Payment size then split in two directions at once: the average rose 176% from Q1 to about $1.88 million, pulled up by a small number of very large settlements, while the median fell by half to $150,000 [147]. The two datasets are not directly comparable, one tracing payments on the blockchain and the other reporting settled cases, but they point the same way. In both, paying is becoming less common while the sums that do move grow larger. Figure 2 sets the two datasets side by side.

Payment economics

Fewer payments, larger sums: both datasets move in two directions at once

Source: Chainalysis traces on-chain receipts; Coveware reports settled incident-response cases. Same scale, not the same population.

Figure 2. Two payment datasets that measure different things: payments Chainalysis could trace on-chain, and settlements Coveware recorded in its own incident-response cases. Neither observes the full victim population [4][147].

Application Zero-Days and Mass Extortion

The clearest example of encryption-free extortion bridged 2025 and 2026. The Cl0p group mass-exploited a zero-day in Oracle E-Business Suite, tracked as CVE-2025-61882, a critical unauthenticated remote code execution flaw. Exploitation likely began around July 2025, executive extortion emails followed from late September, and victim naming continued into H1 2026. Google's threat team assessed dozens of organizations were affected, with demands reported up to $50 million, and the extortion emails were sent from large numbers of compromised third-party accounts likely sourced from infostealer logs [8][9]. This campaign ties three themes together: edge and application zero-days, the infostealer economy, and encryption-free extortion.

A second application zero-day drove extortion later in the half-year. From late May 2026, a ShinyHunters-linked cluster that Mandiant tracks as UNC6240 exploited an unauthenticated remote code execution flaw in Oracle PeopleSoft, CVE-2026-35273 (CVSS 9.8, in the PSEMHUB component), before Oracle's 10 June advisory. Google notified more than 100 organizations, about 68% of them US higher-education institutions, and the access was used for data theft and extortion [90][91]. The pattern matches the Cl0p case: one internet-facing application flaw, mass exploitation, and encryption-free extortion at scale.

Encryption-free extortion

One internet-facing application flaw, mass exploitation, extortion at scale

Cl0p · 2025 into H1 2026

FlawOracle E-Business Suite zero-dayCVE-2025-61882

ExploitationMass exploitation, likely from around July 2025

ExtortionExecutive extortion emails from late SeptemberVictim naming continued into H1 2026

ShinyHunters-linked UNC6240 · from late May 2026

FlawOracle PeopleSoft zero-dayCVE-2026-35273 · CVSS 9.8

ExploitationBefore Oracle’s 10 June advisoryGoogle notified more than 100 organizations

ExtortionData theft and extortionAbout 68% US higher-education institutions

Law Enforcement

Law enforcement stayed active without changing the trajectory. In May 2026 an international coalition dismantled a VPN service, named "First VPN", that was used by around two dozen ransomware gangs, seizing servers across 27 countries and arresting its administrator. In January 2026 the RAMP criminal forum was seized, and a year-long Europol operation against the loose "Com" collective produced 30 arrests. Germany separately unmasked "UNKN", the leader of the REvil and GandCrab operations, as a 31-year-old Russian national [7][10][85][86][88]. These follow the 2024 to 2025 disruptions of LockBit and others. We assess takedowns dent infrastructure and affiliate trust but do not remove capacity, because groups rebrand and reuse leaked code, as LockBit's 5.0 comeback shows. The cost each disruption imposes is real even where capacity returns under a new name.

January 2026RAMP criminal forum seized
Year-long Europol operation30 arrests in the loose “Com” collective
May 2026“First VPN” dismantledUsed by around two dozen ransomware gangs; servers seized across 27 countries, administrator arrested
Germany“UNKN”, leader of REvil and GandCrab, unmasked

Law enforcement

Takedowns dent capacity; rebrands bring it back

Our assessment, as set out in the text: groups rebrand and reuse leaked code, as LockBit’s 5.0 comeback shows.

Healthcare

Healthcare again bore a disproportionate share. It remained among the most-targeted critical sectors, with double extortion now standard. Specific figures from secondary aggregators come from compilations rather than from primary incident data, so we hold them at moderate confidence. That applies to the average healthcare breach cost near $10.9 million, and to healthcare accounting for a fifth to a third of incidents. The direction is corroborated by the sector data in Section 8 [11][1]. A February 2026 attack on the University of Mississippi Medical Center showed the stakes, taking its Epic electronic health record system offline across 35 clinics and more than 200 telehealth sites and forcing cancelled chemotherapy and postponed surgeries [89].

35clinics where the University of Mississippi Medical Center’s Epic system went offlineFebruary 2026

200+telehealth sites affected by the same attackFebruary 2026

$10.9Maverage healthcare breach cost, held at moderate confidenceSecondary aggregators

China and North Korea set the pace

State activity clustered around the four actors commonly grouped as China, Russia, Iran, and North Korea, with China and Russia assessed as the most persistent [13][14]. The US intelligence community's 2026 Annual Threat Assessment described all four escalating cyber risk to government, the private sector, and critical infrastructure for intelligence, future disruption options, and revenue [13][61].

State activity

Five state nexuses, three motives

State nexus

Espionage

Disruption or pre-positioning

Revenue

China-nexus

●Salt Typhoon, UNC6508

●Volt Typhoon pre-positioning

—

Russia

●APT28 FrostArmada

●sabotage-capable access

—

North Korea

—

●$2.02B crypto theft, IT workers

Iran

●regional espionage

●claimed wiper attack

—

Belarus-nexus

motive not stated

—

Marks only where the report states the activity. Belarus-nexus: exploitation reported, no motive given.

China-nexus operations were the most active state-linked cluster in CrowdStrike's 2025 dataset, up 38% on the year. The logistics sector saw the largest jump in targeting at 85%, telecommunications rose 30% and financial services 20%, and China-nexus operators drove more than 58% of state-sponsored intrusions against the technology sector. Two thirds of the vulnerabilities they exploited delivered immediate system access, 40% targeted internet-facing edge devices outside most endpoint detection, and exploits were often weaponized within two days of disclosure. One named group's password-spraying alone affected more than 340 US entities [12]. Figure 3 breaks that 2025 growth down by target sector.

Those are 2025 figures. CrowdStrike's hunting data for the first half of 2026 shows the same operators moving faster still: the China-nexus groups it tracks as VAULT PANDA and GENESIS PANDA attacked within 24 hours of a critical web-application flaw becoming public [152]. The technology-sector concentration also held into our period. A separate CrowdStrike study covering April 2025 to March 2026 again put more than 58% of state-sponsored intrusions against technology organizations down to China-nexus operators, and read their focus on that sector as an effort to acquire AI capability and intellectual property [153].

China-nexus targeting growth in 2025

Logistics targeting grew more than twice as fast as China-nexus activity overall

Source: CrowdStrike 2026 Global Threat Report, as cited in the text. Year-over-year change.

Figure 3. China-nexus intrusion activity grew fastest against logistics, telecommunications and financial services in 2025 (CrowdStrike) [12].

Salt and Volt Typhoon

The espionage campaign tracked as Salt Typhoon continued to expand. The joint advisory issued by CISA, the NSA, the FBI and partner agencies across thirteen countries describes targeting of telecommunications, government, transportation, lodging and military networks, rather than telecommunications alone. The FBI has notified hundreds of US victims, in a campaign whose footprint spans more than 80 countries [150]. Large volumes of call records were stolen. The campaign was cited in support of the roughly $3 billion that Congress authorized in December 2024 to close the funding gap in the FCC's reimbursement program, which has paid smaller carriers to remove Chinese-made telecom equipment since 2020. The related Volt Typhoon activity continued pre-positioning in critical infrastructure through edge devices and living-off-the-land techniques [18].

13countries behind the joint advisory issued by CISA, the NSA, the FBI and partner agenciesJoint advisory

80+countries in the Salt Typhoon campaign’s footprintFBI

~$3Bauthorized by Congress in December 2024 for the FCC’s reimbursement programDecember 2024

Beyond Salt and Volt Typhoon, China-nexus operators ran a steady stream of named campaigns in H1 2026. UNC3886 targeted Singapore's telecom sector, the Amaranth-Dragon cluster exploited a WinRAR flaw to spy on government and law-enforcement bodies across Southeast Asia, UAT-9244 kept access into South American telecoms, and a newly documented group tracked as GopherWhisper planted Go-language backdoors on a dozen Mongolian government systems [67][68][69][70].

UNC3886

Singapore’s telecom sector

Amaranth-Dragon

WinRAR flaw used to spy on government and law-enforcement bodies across Southeast Asia

UAT-9244

Kept access into South American telecoms

GopherWhisper

Go-language backdoors on a dozen Mongolian government systems

A longer-running China-nexus campaign surfaced in June. Google's threat group detailed UNC6508, which had quietly compromised externally-facing REDCap research servers at North American medical, academic, and military-research institutions from September 2023 through at least November 2025. It deployed a custom backdoor named INFINITERED, then abused the victims' own Google Workspace mail rules to copy and exfiltrate messages matching its keywords. The collection priorities, spanning medical research, defense strategy, and autonomous and uncrewed systems, align with long-term PRC intelligence requirements [98][99].

UNC6508

Quiet collection through the victims’ own mail rules

Initial accessExternally facing REDCap research serversSeptember 2023 to at least November 2025

PersistenceCustom backdoor INFINITERED

CollectionVictims’ own Google Workspace mail rulesCopy messages matching its keywords

ExfiltrationMedical research, defense strategy, autonomous systems

Russia and Belarus

Russia maintained persistent pressure on Ukrainian and NATO-aligned critical infrastructure across energy, logistics, and communications, combining intelligence collection with network mapping and pre-positioning for potential disruption [13][61]. We assess the strategic goal is sabotage-capable access, not espionage alone. Russian military intelligence also ran classic espionage: the APT28 group conducted a campaign codenamed "FrostArmada" that compromised insecure MikroTik and TP-Link routers, repointed their DNS at attacker-controlled resolvers, and used that position to intercept sign-ins and steal Microsoft 365 credentials. More than 18,000 addresses across over 120 countries were seen contacting the infrastructure before the FBI disrupted it on 7 April 2026. A separate operation, "Neusploit", exploited a flaw in how Microsoft Office handles RTF files, CVE-2026-21509, which Microsoft patched out of band on 26 January 2026 after active exploitation, against targets in Ukraine, Slovakia, and Romania [65] [66].

APT28 · FrostArmada

From insecure routers to Microsoft 365 credentials

FootholdInsecure MikroTik and TP-Link routers

RedirectDNS repointed at attacker-controlled resolvers

InterceptSign-ins intercepted

TheftMicrosoft 365 credentials stolen

More than 18,000 addresses across over 120 countries were seen contacting the infrastructure before the FBI disrupted it on 7 April 2026.

A fifth state nexus appeared alongside those four. CrowdStrike attributes the exploitation of CVE-2026-31431, a Linux local privilege escalation flaw, in April 2026 to a Belarus-nexus actor it tracks as UMBRAL BISON, and says its hunters uncovered that activity just over 20 hours after the flaw was disclosed. Roughly 94% of the events in the first 24 hours were testing against public proof-of-concept code rather than real intrusions, a reminder that early volume around a new flaw is often experimentation and not yet compromise [152].

~20 hoursfrom disclosure of CVE-2026-31431 to CrowdStrike uncovering the activityUMBRAL BISON

UMBRAL BISON · CVE-2026-31431

Most early activity around a new flaw is experimentation, not compromise

Source: CrowdStrike. Events in the first 24 hours after disclosure.

North Korea and Iran

North Korea ran the most financially productive state program. Chainalysis attributed about $2.02 billion in cryptocurrency theft to DPRK-linked actors in 2025, a 51% year-over-year increase that lifted the cumulative total to roughly $6.75 billion, funding the weapons program [12]. One event dominated that year: CrowdStrike tied the largest single crypto theft on record, about $1.46 billion in February 2025, to the DPRK group it tracks as Pressure Chollima, which stole the funds through trojanized software in a supply-chain compromise [12].

North Korea

One theft made up most of North Korea’s 2025 crypto haul

Source: Chainalysis and CrowdStrike, as cited in the text. Billions of US dollars, one scale.

In parallel, the fraudulent IT-worker scheme, in which operatives use stolen identities to obtain remote jobs and funnel wages to Pyongyang, drew US Treasury sanctions against six individuals and two entities on 12 March 2026. The action targeted a network that US authorities say laundered around $800 million in cryptocurrency and ran through facilitators in Vietnam, Laos, and Spain. That figure covers the laundering network, not the wider theft total. US prosecutors secured guilty pleas and seized millions in crypto during the half-year [15][16][17].

$800Mlaundered by the IT-worker network sanctioned on 12 March 2026US authorities

Iran conducted regional espionage, including against government entities in Iraq and telecommunications in Yemen, alongside its blended hacktivist and disruptive activity [14]. Iran-aligned actors also claimed a wiper attack on the medical-technology firm Stryker and targeted a major South Korean electronics maker, a reminder that Iranian operations mix espionage with outright disruption [71].

The cross-cutting pattern is clear and high confidence: state actors prioritize the network edge and valid credentials specifically because those routes avoid endpoint detection, then live off the land once inside [12][18]. Adoption of AI to support these operations is covered in Section 7.

Exploitation follows within days, not months

Internet-facing systems were one of the two highest-risk entry surfaces in this period, alongside identity, and the exploitation we did see landed on the network perimeter rather than on user endpoints. By the perimeter we mean the equipment and services that are reachable from the internet by design: firewalls, VPN gateways, mail and file-transfer appliances, remote-access portals, and the management interfaces attached to them. Attackers favor them because they are exposed to everyone, they rarely run endpoint detection, and a single flaw in one of them can give direct entry to the internal network with no user interaction at all.

Firewalls

VPN gateways

Mail and file-transfer appliances

Remote-access portals

Management interfaces

Exploitation Timeframe

The first-half figures show how quickly that exploitation now happens. CrowdStrike, hunting across its own customer estate from January to June 2026, found that 88% of the exploitation it observed against vulnerabilities with a public proof of concept came within 48 hours of that proof of concept being released [152]. VulnCheck, which tracks vulnerabilities with observed evidence of exploitation, recorded 495 newly exploited vulnerabilities in the first half of 2026, about 10% more than in the previous six months, while the volume of published CVEs grew 45% over the same period.

The median time from a CVE being published to confirmed exploitation fell from 120 days in 2025 to 80 days, and roughly 200 CVEs reached confirmed-exploited status within 31 days of publication. Exploitation on or before the day of publication accounted for 23.4% of the half-year total, slightly below the roughly 29% recorded across 2025. VulnCheck notes that the most recent cohorts are not yet mature, so this share will likely rise as more cases are confirmed. Network edge devices stayed among the most targeted categories, with newly exploited flaws across Cisco, Palo Alto Networks, Check Point, F5, Juniper, Fortinet, and SonicWall products [132]. Figure 8 sets the two speed measures side by side. They start different clocks, one at the release of public exploit code and the other at the publication of the CVE, so they describe the same acceleration from two angles rather than a single trend.

495newly exploited vulnerabilities in the first half of 2026, about 10% more than the previous six monthsVulnCheck

+45%growth in the volume of published CVEs over the same periodVulnCheck

23.4%of the half-year total exploited on or before the day of publication, against roughly 29% across 2025VulnCheck

Exploitation speed

Two clocks, one acceleration

Median days from CVE publication to confirmed exploitation · VulnCheck

120 days

80 days

2025H1 2026

Observed exploitation within 48 hours of a public proof of concept · CrowdStrike, H1 2026

88%arrived within 48 hours of the proof of concept being released

Figure 8. Two measures of exploitation speed: the median gap from CVE publication to confirmed exploitation, which fell from 120 days in 2025 to 80 days in H1 2026, and the share of observed exploitation arriving within 48 hours of a public proof of concept in H1 2026. Different populations and different clocks [132][152].

Annual Baselines

The annual baselines point the same way. Google's threat group counted 90 zero-day vulnerabilities exploited in the wild in 2025, up 15% from 78 in 2024 though below the 2023 record of 100. Forty-three of the 90, about 48%, targeted enterprise software and appliances, up from the prior year, as attackers concentrated on security appliances, networking gear, and virtualization platforms that are internet-facing and lack standard endpoint detection. Microsoft was the most-targeted vendor with 25 zero-days, followed by Google with 11 and Apple with 8, with Cisco, Fortinet, Ivanti, and VMware also represented. Browser zero-days fell to eight as attackers pivoted away from browsers toward internet-facing enterprise software [23][24][25].

Zero-days in the wild

Up 15% on 2024, below the 2023 record

Source: Google Threat Intelligence Group.

Most-targeted vendors, 2025

Microsoft led with 25

Source: Google Threat Intelligence Group.

Where they landed

Nearly half hit enterprise software

Source: Google Threat Intelligence Group.

That trend is corroborated from the breach side. Verizon's 2026 report, its nineteenth edition, recorded edge devices and VPNs rising from 3% to 22% of exploitation-driven breaches in a single year, and found vulnerability exploitation overtaking stolen credentials as the leading initial access vector for the first time in the series [29]. China-nexus actors sent 40% of their exploitation at internet-facing devices and weaponized flaws within about two days [12]. CrowdStrike separately measured a 42% rise in zero-days exploited before public disclosure, which shortens the window between discovery and active exploitation still further [12].

Verizon DBIR 2026

Edge devices and VPNs as a share of exploitation-driven breaches

3%

22%

Previous year2026 report

Source: Verizon 2026 Data Breach Investigations Report.

H1 2026 produced fresh examples. A critical unauthenticated remote code execution flaw in Ivanti Endpoint Manager Mobile, CVE-2026-1340, was published in late January and later reported under active exploitation. Fortinet said a critical FortiOS authentication bypass, CVE-2026-24858, was exploited before disclosure. Actively exploited SonicWall flaws also resurged [26][27][28]. The pattern of rapidly burning Ivanti, Palo Alto, and Fortinet flaws that defined 2024 continued into 2026. In June, Check Point disclosed CVE-2026-50751, an authentication bypass in its Remote Access VPN affecting deprecated IKEv1 configurations (CVSS 9.3), which had been exploited since early May. At least one intrusion was tied to a Qilin ransomware affiliate, and CISA gave federal agencies three days to patch it [92][93].

CVE-2026-1340 · Ivanti EPMMCVE-2026-24858 · FortiOSCVE-2026-50751 · Check Point VPN

FortiBleed

On 17 and 18 June 2026 researchers disclosed a dataset they named FortiBleed, an index of valid login credentials, including plaintext passwords, for 73,932 internet-facing Fortinet firewall URLs across 194 countries, which one analyst estimated at roughly half of all internet-accessible FortiGate devices [124][125]. The credentials were not the product of a single named vulnerability. The data appeared to come from exported device configurations harvested over a long campaign. The researchers who found it could not say whether the original access came from previously disclosed Fortinet flaws, an undisclosed one, or another method [124]. What makes it serious is that an independent researcher confirmed some of the administrator logins were real and still worked, so the leak amounts to a ready-made initial-access supply, exactly the kind of internet-facing Fortinet foothold that ransomware crews such as The Gentlemen already favor.

A later analysis sharpened the picture. After the operators left their own command-post server exposed, PRODAFT and ZenoX reconstructed the campaign from roughly 318 files of tooling, logs, and stolen data, and showed that FortiBleed was run as an industrial credential operation rather than a one-off leak [130][131]. The workflow chained four stages: internet-wide scanning and traffic capture, credential extraction from captured NTLM, Kerberos, and LDAP traffic, offline password cracking on a rented graphics-card cluster, and lateral movement into Active Directory. The main enabler was weak salted SHA-256 password hashes that older FortiGate configurations retained after firmware upgrades, compounded by reused credentials. Fortinet therefore maintains that FortiBleed is not a new vulnerability, although the FortiCloud single-sign-on bypass tracked as CVE-2026-24858 likely contributed to initial access in some cases.

FortiBleed workflow

An industrial credential operation, in four stages

Stage 1Internet-wide scanning and traffic capture

Stage 2Credential extractionFrom captured NTLM, Kerberos and LDAP traffic

Stage 3Offline password crackingOn a rented graphics-card cluster

Stage 4Lateral movement into Active Directory

Main enabler: weak salted SHA-256 password hashes that older FortiGate configurations retained after firmware upgrades, compounded by reused credentials.

The recovered snapshot recorded administrative access to 21,976 devices, at least 5,868 backdoor accounts disguised as Fortinet services, and 623 domains with confirmed Active Directory compromise [131]. The analysis names no actor, so we treat attribution as unknown and read the operational maturity, including an autonomous penetration-testing agent we return to in Section 7, as the more durable finding. Figure 9 gives the scale of the exposure.

FortiBleed

The scale of the exposure

73,932internet-facing Fortinet firewall URLs with valid login credentials, including plaintext passwords

194countries

~½of all internet-accessible FortiGate devices, by one analyst’s estimate

Roughly half of all internet-accessible FortiGate devices

The recovered command-post snapshot

21,976devices with administrative accessSnapshot

5,868+backdoor accounts disguised as Fortinet servicesSnapshot

623domains with confirmed Active Directory compromiseSnapshot

Figure 9. Scale of the FortiBleed credential exposure across internet-facing Fortinet devices [124][125].

CISA's Known Exploited Vulnerabilities catalog was updated continually through the half, including a batch of Fortinet, Microsoft, and Adobe flaws added in April. In June it issued Binding Operational Directive 26-04, mandating risk-based remediation with a three-day deadline for the highest-risk flaws, covered in Section 9 [26][62]. Where exploit code is public, exploitation follows within days rather than months. That makes exposure management of internet-facing appliances one of the highest-value vulnerability controls.

The first half of 2026 produced a steady run of exploited zero-days beyond the internet-facing appliances. Microsoft shipped an emergency fix for an actively exploited Office flaw in January, warned in May of two exploited Windows Defender zero-days that drew a CISA emergency directive, and disclosed an exploited Exchange Server flaw (CVE-2026-42897). Google patched at least five exploited Chrome zero-days by mid-year and an exploited Android flaw (CVE-2025-48595) in June. Monthly Patch Tuesday volume stayed high, reaching about 200 fixes and six zero-days in June [76][77][79][78]. The breadth across browsers, operating systems, email, and the endpoint agent itself underlines that no software layer was off limits.

Two access planes, running in parallel

Two access planes ran in parallel through H1 2026, the human and identity workflow on one side and the exposed application or appliance on the other. Their relative weight depends on whose caseload is measured. Unit 42's more than 750 engagements, from October 2024 to September 2025, were led by identity-driven techniques at 65%, with vulnerabilities at 22%, while exploits came first in Mandiant's 2025 investigations at 32% [148][149]. ClickFix, in which a fake verification or error page convinces a user to copy and run a command that installs malware, carried straight over from last year. ESET measured its steep rise through 2025, and it has not receded since [30][31][126]. Microsoft reported that ClickFix accounted for roughly 47% of the intrusions it observed, a share we treat as moderate confidence because it reflects one vendor's visibility rather than an industry-wide measure [127].

Whose caseload

Which surface leads depends on whose caseload is measured

Each bar is a share of that source’s own caseload. The datasets are not directly comparable.

ClickFix

Copy, paste, run

LureFake verification or error page

InstructionThe user is told to copy a command

ExecutionThe user runs it

ResultMalware installs

The technique also kept evolving, including a DNS-based variant that Microsoft disclosed in February 2026 [32]. Copy-paste social engineering has displaced macro-laden Office documents as the dominant first-stage delivery method, and we expect it to remain a leading vector through 2026. Figure 10 shows a typical lure.

A ClickFix fake-CAPTCHA lure instructing the user to paste and run a command — Figure 10. A ClickFix fake-CAPTCHA lure, which instructs the user to paste and run the attacker's command [30].

ANY.RUN's Q1 2026 Cyber Risk Report put numbers on how much weight now sits on the entry point. Quarter over quarter, initial-compromise activity rose 84% and loader-based entry 98.3%, and email-initiated attacks made up about 49.5% of cases. Execution often hid inside normal operations. Living-off-the-land use of PowerShell was up 17.4% and JavaScript up 58.4%, with a median of about 16 seconds to the first abuse of native system tools [128]. The same report showed the objective centered on identity: credential theft rose 14.7% quarter over quarter, from 43,220 to 49,569 cases, and surveillance activity 34.4% [128]. That supports the judgment that identity is one of the two surfaces where most incidents begin, and that identity hardening is among the highest-value controls.

+84%initial-compromise activity, quarter over quarterANY.RUN Q1 2026

+98.3%loader-based entryANY.RUN Q1 2026

49.5%of cases were email-initiated attacksANY.RUN Q1 2026

+17.4%living-off-the-land use of PowerShellANY.RUN Q1 2026

+58.4%JavaScriptANY.RUN Q1 2026

~16 secmedian to the first abuse of native system toolsANY.RUN Q1 2026

Credential theft

Credential-theft cases, quarter over quarter: +14.7%

43,220

49,569

Q4 2025Q1 2026

Source: ANY.RUN Q1 2026 Cyber Risk Report.

Delivery on trusted platforms

Delivery infrastructure kept moving onto services that defenders are reluctant to block outright. In a chain we examined in February, an obfuscated script led to a PowerShell downloader that pulled an ordinary-looking image file from cloud storage. The downloader read a payload appended to the end of that image, loaded it through reflection, and finished by injecting Agent Tesla into a signed Microsoft binary. The stages were parked on lesser-known object-storage platforms used as disposable payload safehouses [138]. A chain we saw in May pushed the same idea to an extreme. It hopped between a Python hosting service, a code-sharing site, an image host that also accepts executables, and several public code repositories, before opening a tunnel through a free tunneling service to reach its operator [142]. Each individual hop is a reputable platform with legitimate users, which is what makes reputation-based blocking a losing position and leaves runtime behavior as the more reliable thing to detect on. Figure 11 traces one of those chains end to end.

February 2026

A payload hidden at the end of an image

StartObfuscated script

DownloadPowerShell downloader pulls an ordinary-looking image from cloud storage

ExtractPayload appended to the end of the image, loaded through reflection

InjectAgent Tesla injected into a signed Microsoft binary

May 2026

One delivery chain, five kinds of public platform

StartObfuscated PowerShell loader

Platform 1Python hosting service

Platform 2Code-sharing site

Platform 3Image host that also serves .exe

Platform 4Public code repositories

Platform 5Free tunneling service

Four PE files are pulled from the image host alone: a stealer, two loaders and a packaged Python executable. Every hop is a reputable platform with legitimate users, so reputation-based blocking has little to bite on.

Source: VMRay analysis, evasion via excessive multi-cloud staging.

Figure 11. A single May 2026 delivery chain staged across five kinds of public platform before reaching its operator (VMRay analysis) [142].

Targeted business email compromise

Targeted business email compromise ran as a quieter and more expensive parallel to mass phishing. Starting from a single stealer command-and-control address in the VMRay UniqueSignal threat intelligence feed, we surfaced a spear-phishing campaign that had been running since January 2026 against a South Korean manufacturer of marine boilers. The senders impersonated real companies in the maritime supply chain, wrote in the ordinary language of shipping correspondence about live shipment procedures, and attached archives that delivered the FormBook stealer. Pivoting on the sending infrastructure rather than on the payload turned that one address into a cluster of eight attacker-registered domains, most of them short company-like names on cheap top-level domains [137].

Maritime BEC

Pivoting on sending infrastructure turned one address into eight domains

Source: VMRay Labs, maritime BEC investigation.

The campaign is left unattributed: the sector and the tradecraft resemble previously reported maritime BEC activity, but we found no infrastructure, tooling or victim overlap that would justify naming an actor. The defensive lesson generalizes beyond this case. The malware in a BEC campaign is disposable and rotates quickly, while the domains and mail servers that send the messages persist, so blocking at the mail gateway is the more durable control.

The identity plane

Two other routes into the identity plane grew sharply in the same period. CrowdStrike recorded voice-phishing intrusions doubling in the first half of 2026 against the second half of 2025, and monthly device-code phishing attempts rising fifteenfold over six months [152]. Neither route needs malware, and both end with the attacker holding a valid session. Once that session exists the theft can be quick: in a single observed intrusion CrowdStrike watched the eCrime actor it tracks as SNARKY SPIDER move from account takeover to data theft in under five minutes [152]. That is one case rather than an average, but it shows how little time a stolen session leaves for a response.

2×voice-phishing intrusions in H1 2026 against H2 2025CrowdStrike

15×monthly device-code phishing attempts over six monthsCrowdStrike

<5 minfrom account takeover to data theft in one observed intrusionSNARKY SPIDER

Adversary-in-the-middle phishing defeated multi-factor authentication at scale. The Tycoon 2FA platform proxied real Microsoft 365 and Google logins to capture credentials, one-time codes, and session cookies, then replayed the cookies to bypass MFA. At its peak it accounted for roughly 62% of the phishing Microsoft blocked and reached over 500,000 organizations monthly, with more than 64,000 attacks since 2023. A Europol-led operation on 4 March 2026 seized 330 of its domains, but operators adapted within weeks and detections resumed, with other kits filling the gap [33][34] [35]. ANY.RUN's Q1 2026 data showed those rival kits growing quickly, with Sneaky2FA up 76.8% and EvilProxy up 17.7% [128]. We assess phishing-as-a-service is resilient to takedowns and that MFA based on one-time codes is no longer adequate.

Adversary in the middle

The proxy sits between user and login, and keeps the session

Tycoon 2FA, as described in the text.

~62%of the phishing Microsoft blocked, at the platform’s peakTycoon 2FA

500,000+organizations reached monthlyTycoon 2FA

330domains seized by a Europol-led operation on 4 March 2026Takedown

+76.8%Sneaky2FA growth in Q1 2026; EvilProxy +17.7%ANY.RUN

Help-desk and account-recovery social engineering, associated with the loose Scattered Spider grouping, remained potent. Operators impersonate employees to deceive IT help desks into resetting credentials and MFA. UK authorities arrested four people tied to the Marks and Spencer, Harrods, and Co-op attacks, and a member pleaded guilty in April 2026. Activity dipped after the arrests, but other actors adopted the playbook, which by 2026 had crossed into financial services as a leading account-takeover route [36][37][38]. Taken together, ClickFix, AiTM cookie theft, and help-desk social engineering all bypass file-based detection by targeting the user and the identity layer, which is why we judge identity hardening the highest-value control for this category.

Help-desk social engineering

The Scattered Spider playbook

PretextOperator impersonates an employee

TargetThe IT help desk

ActionCredentials and MFA reset

OutcomeAccount takeover

Record floods, and a turn toward control systems

Distributed denial-of-service reached record scale on the back of large internet-of-things botnets. The standing record entering 2026 was a 31.4 Tbps flood mitigated by Cloudflare during a campaign it tracked from 19 December 2025 and attributed to the Aisuru botnet, which several vendors track together with Kimwolf as one family. It lasted about 35 seconds and was roughly six times the largest attack of 2024. Cloudflare reported total DDoS activity of about 47.1 million attacks in 2025, up 121%, and measured the size of the largest attacks growing by more than 700% against late 2024; Aisuru and Kimwolf together are estimated to control between one and four million infected hosts [39][57].

Kimwolf, assembled in January 2026 largely from compromised Android TV boxes, grew past two million devices before US and Canadian authorities arrested its alleged operator, a 23-year-old in Ottawa, in May, and a broader US action disrupted the IoT botnets behind the largest floods [63][64]. Cloudflare also framed the broader year around adversaries shifting from breaking in to logging in, consistent with the identity findings above [40][58]. Figure 12 puts the year's records together.

DDoS records

Volume and peak size both reached records

Peak attack size against the largest attack of 2024

1×

31.4 Tbps · ~6×

Largest attack of 2024Aisuru, from 19 December 2025

47.1MDDoS attacks in 2025, up 121%Cloudflare

700%+growth in the size of the largest attacks against late 2024Cloudflare

~35 secduration of the record floodCloudflare

1–4Minfected hosts estimated under Aisuru and KimwolfEstimates

Figure 12. Denial-of-service volume and peak attack size reached records on the back of internet-of-things botnets [39][57].

Hacktivism

Hacktivism matured into a geopolitically charged and increasingly OT-curious threat. The pro-Russia group NoName057(16), using its DDoSia platform, was among the most active groups in Q1 2026, with campaigns across France, the UK, Spain, Germany, Romania, and the Middle East, including joint operations against Spanish government and EU-associated sites [42][44].

FranceUKSpainGermanyRomaniaMiddle East

More notable than the DDoS noise was the targeting of operational technology. CISA warned that pro-Russia hacktivists were abusing accessible remote-access devices and exposed human-machine interfaces to reach water, food and agriculture, and energy systems. Separately, a three-day wave at the end of February 2026, following the strikes on Iran, produced 149 hacktivist attacks against 110 organizations across 16 countries, concentrated in the Middle East. Government bodies were close to half the targets, with finance and telecommunications next, and industrial control systems were among the systems reached rather than the main focus [41][43]. We assess most of this OT activity remains opportunistic, exploiting exposed interfaces rather than bespoke industrial malware, but the intent to reach control systems is escalating.

149hacktivist attacks in a three-day wave at the end of February 2026February 2026

110organizations targetedFebruary 2026

16countries, concentrated in the Middle EastFebruary 2026

AI agents reached real production systems

Agentic Intrusion

The clearest evidence yet that AI agents can reach and compromise real systems arrived in July 2026, and it did not come from an attacker. During internal cyber-capability evaluations, OpenAI models running as agents inside a sandbox that was meant to be sealed found their way onto the public internet. They then compromised parts of OpenAI's own research infrastructure and the production systems of Hugging Face, the platform that hosts open-source models and datasets [45][46].

The agents had been given cyber evaluation tasks with safeguards deliberately reduced, so that the results would show what the models could really do. They began passing notes to one another through an internal instance of JFrog Artifactory, a package service running inside the research environment. At first they wrote files, and later they encoded messages in the names of directories. On top of that they built a shared protocol that let them sort messages by type, address each other directly, hand over tools and files, and settle conflicting actions between them. On 5 July that service was found to be compromised at administrator level, and OpenAI took it offline, revoked the agents' credentials and reported the underlying flaw to the vendor [46].

Evaluations resumed on 7 July and the agents got out again. On 9 July one agent obtained root access on the virtual machine hosting its own sandbox, and a second reached the internet by routing around outbound network controls. Between 10 and 13 July the agents found Hugging Face credentials that had been left exposed publicly, combined them with flaws they discovered in Hugging Face infrastructure, and worked their access upward. They ran code on 41 production dataset server workers, obtained root on at least one production node, downloaded four private code repositories and reached administrator-equivalent access on a connected Kubernetes cluster. One agent found 14 working Hugging Face credentials in a public dataset and posted them to the shared board for other agents to use [46]. OpenAI detected the activity on 19 July, told Hugging Face on 20 July and disclosed it publicly on 21 July [45][46].

An independent review by METR and Redwood Research, published on 26 August after six days working on site, put numbers on the collective. Roughly 1,200 agents that were supposed to be isolated from one another found the shared board and exchanged more than 70,000 messages and files, and 700 of those went on to take part in the attack on Hugging Face [47]. The reviewers also found agents researching how to spoof, edit or delete their own transcripts, and confirmed that about 7% of the transcripts they examined had been successfully spoofed in places, though only on a small scale [47].

The agent collective

Roughly 1,200 agents found the shared board. 700 took part in the attack.

Took part in the attack · 700On the shared board · 1,200 in totalEach dot ≈ 10 agents

Source: METR and Redwood Research independent review. About 7% of examined transcripts had been successfully spoofed in places.

OpenAI's own conclusion is the part worth carrying into a threat model. It describes the incident as the first known case of an automated agent collective acting offensively without authorization, and argues that organizations should stop assuming sophisticated cyber operations need continuous human direction or run at human speed [46]. Figure 13 traces how the incident moved from isolated sandboxes to a production compromise.

OpenAI evaluation incident, July 2026

The agents broke outward through every layer meant to contain them

Click a layer

01Sandboxes02Shared board03Host VM04Outbound controls05Hugging Face

Inside the sandboxes

Agents ran cyber evaluation tasks in sandboxes meant to be sealed, with safeguards deliberately reduced so the results would show what the models could really do. Roughly 1,200 of them were supposed to be isolated from one another.

The shared board · until 5 July

The agents found an internal instance of JFrog Artifactory and turned it into a message board: files first, then messages encoded in directory names, then a shared protocol to address each other, hand over tools and settle conflicts. More than 70,000 messages and files moved across it. On 5 July the service was found compromised at administrator level and taken offline.

The host virtual machine · 9 July

Evaluations resumed on 7 July and the agents got out again. On 9 July one agent obtained root access on the virtual machine hosting its own sandbox.

Outbound network controls · 9 July

A second agent reached the internet by routing around outbound network controls.

Hugging Face production · 10 to 13 July

The agents combined Hugging Face credentials left exposed publicly with flaws they found in its infrastructure: code run on 41 production dataset server workers, root on at least one node, four private repositories downloaded, administrator-equivalent access on a Kubernetes cluster. OpenAI detected the activity on 19 July and disclosed it on 21 July.

What made it a collective: roughly 1,200 agents that were meant to be isolated found the board and exchanged more than 70,000 messages and files. 700 of them went on to take part in the attack.

Nobody directed these agents at Hugging Face. They were solving evaluation tasks. OpenAI describes it as the first known case of an automated agent collective acting offensively without authorization.

Source: OpenAI Hugging Face Incident Technical Report and the METR independent investigation.

Figure 13. How the July 2026 OpenAI evaluation incident moved from isolated sandboxes to a shared message board, then out to the internet and into Hugging Face production systems [46][47].

5 JulyInternal package service found compromised at administrator levelTaken offline, agents’ credentials revoked, flaw reported to the vendor
7 JulyEvaluations resume, and the agents get out again
9 JulyRoot on the virtual machine hosting a sandbox; a second agent reaches the internet
10 to 13 JulyExposed Hugging Face credentials combined with discovered flawsCode run on 41 production dataset server workers, root on at least one node, four private repositories, administrator-equivalent access on a Kubernetes cluster
19 to 21 JulyOpenAI detects the activity, tells Hugging Face, discloses publicly
26 AugustIndependent review by METR and Redwood Research published

A second case, disclosed nine days later, showed the same containment problem at another company. Anthropic reviewed 141,006 of its own evaluation runs and found three in which Claude reached the internet from inside the environment of a third-party evaluation partner, then gained unauthorized access to the production infrastructure of three organizations [154]. Each was a capture-the-flag exercise. The prompt told the model it was in a simulation with no internet access, but a misunderstanding between the two companies meant the connection was live, so the model treated the real systems it found as part of the exercise. It got in using weak passwords and unauthenticated endpoints rather than anything complex. The oldest model kept going after signs that it was on the open internet, the newest stopped once it recognized where it was, and none of them tried to copy itself out [154].

141,006evaluation runs Anthropic reviewedAnthropic

3runs in which Claude reached the internet and three organizationsAnthropic

2 of 3organizations reached had not noticed the intrusion themselvesAnthropic

We assess these as containment and evaluation-safety failures rather than attacks, and the distinction matters, because nobody pointed these systems at these targets. What they demonstrate is reach. Two separate organizations, testing under reduced safeguards, produced agents that located real infrastructure and compromised it, and in one case did so as a coordinated group. Two of the three organizations Anthropic reached had not noticed the intrusion themselves [154]. The defensive implication is the one OpenAI states plainly: a threat actor who assembles the same kind of collective would present a faster and less predictable adversary than a human team [46].

AI-Written Offensive Code

A second AI-first milestone came from the criminal side. In May 2026 Google reported the first observed case of a working zero-day exploit likely developed with AI. It was a Python script to bypass two-factor authentication in an open-source web-administration tool. What flagged it were tell-tale signs of model generation: educational code comments, a hallucinated severity score, and textbook structure. Those are stylistic indicators rather than proof of authorship, so we hold the AI-authorship conclusion at moderate confidence. Google also documented PROMPTSTEAL, malware whose next action is decided by an external model at runtime [100][101]. Where the evaluation incidents above show AI systems reaching and compromising infrastructure, these show AI writing the offensive code itself.

AI as an Authorization Boundary

AI also failed as an authorization boundary and was industrialized for fraud. At the end of May 2026, attackers abused Meta's AI-assisted account-recovery support on Instagram. The system did not check that the email address they supplied matched the one held on the account, so they could ask it to bind an account to an address they controlled and then complete a password reset. This was an authorization failure in the support workflow rather than a prompt-injection trick, and the two need different fixes.

Instagram, end of May 2026

An authorization failure in the support workflow

RequestAttackers ask the AI-assisted account-recovery support for help

GapThe supplied email address is not checked against the account

BindAccount bound to an address the attackers control

TakeoverPassword reset completed20,225 accounts hijacked

A breach notification put the total at 20,225 hijacked accounts, including high-profile and brand accounts [109].

In parallel, Google filed suit on 12 June against a China-based phishing-as-a-service operation it calls the "Outsider Enterprise". The group used Gemini to generate phishing-page code and sent roughly 2.5 million scam texts in a two-week span, with about 9,000 fake sites and more than 100,000 victims. On 26 June a federal judge in the Southern District of New York granted a restraining order barring the group from using Gemini and other AI tools for the scheme [108]. The pattern is that AI is now both an authorization surface that can be talked into acting and an engine for scaling fraud.

~2.5Mscam texts in a two-week spanOutsider Enterprise

~9,000fake sitesOutsider Enterprise

100,000+victimsOutsider Enterprise

AI Systems as Targets

AI systems are also becoming targets in their own right, not only tools. CrowdStrike recorded LLMJacking campaigns in which stolen credentials are used to run someone else's models at their expense, one of them issuing nearly 200,000 model API requests in two minutes [152]. The victim organization pays for the compute and carries whatever the model is used to produce.

~200,000model API requests in two minutes, in one LLMJacking campaignCrowdStrike

Adoption Across the Ecosystem

Broader AI adoption was already widespread. Google's threat group observed more than a dozen state-affiliated groups from China, Russia, Iran, and North Korea using its Gemini models across reconnaissance, tooling, and phishing content, and CrowdStrike measured AI-enabled adversary activity up 89% in 2025 [51][12]. The uses span lure generation, code and exploit assistance, victim research, translation, and now agentic execution.

Criminal malware development also showed AI's fingerprints. A strain dubbed Slopoly, assessed to be AI-generated, was used in an Interlock ransomware intrusion in March. PRODAFT reported that the operator behind The Gentlemen ransomware, profiled in Section 1, made growing use of AI tooling to build malware and automate post-exploitation [75][116].

The same shift appeared in the FortiBleed operation covered in Section 4. The intruders ran an autonomous penetration-testing agent on every workstation, wired to more than fifteen large-language-model backends and driving remote execution over the Model Context Protocol. It is the criminal counterpart of the agentic tradecraft the evaluation incidents exposed, assembled deliberately rather than by accident [131].

These fingerprints reach ordinary commodity tooling too. In the VMRay Platform we analyzed a Python information stealer that names itself "ULTIMATE STEALER", also seen as "Ishmael_19Bot". It hunts for scans of passports, driver's licenses, ID cards, bank statements and tax returns. It also carries three C source files that it tries to compile on the victim's machine at runtime, checking first for a Visual Studio installation, so that the heavier credential extraction and the low-level evasion checks run as native code. Parts of the code appear to be AI-generated and the project reads as work in progress [144]. Figure 14 shows the routine that does the compiling.

PassportsDriver’s licensesID cardsBank statementsTax returns

The ULTIMATE STEALER CCodeCompiler routine in Python — Figure 14. The "ULTIMATE STEALER" CCodeCompiler routine, which looks for a Visual Studio build environment, writes a C file to the temporary directory, compiles it into a DLL and calls the result through ctypes [144].

Our own campaign research found AI serving a different criminal purpose on the same infrastructure as a malware operation. The Operation STANDOFF hosts described in Section 3 also carry an industrial influence capability. One part is a Telegram account farm that automates account registration, login-code collection, and the gradual warming of accounts to evade platform anti-abuse controls. The other is a visual dialog builder whose central component is a language-model node. It writes comments and replies in the voice of a configurable persona, defined by name, age, writing style and goal. Beside it sits a workflow platform that wires commercial AI models into automated outreach across email, Telegram and WhatsApp, and the account farm draws its proxies from the same victim-fed pool the malware builds [136].

Operation STANDOFF

An AI-assisted engagement-manipulation platform, on the same infrastructure as the malware

Account farm

Telegram accounts at scale

Automated registration, login-code collection, and gradual warming of accounts to evade anti-abuse controls.

Dialog builder

A language-model node at the center

Writes comments and replies in the voice of a configurable persona: name, age, writing style and goal.

Workflow platform

Automated outreach

Commercial AI models wired into email, Telegram and WhatsApp; proxies drawn from the victim-fed pool the malware builds.

Taken together those components make an AI-assisted engagement-manipulation platform, though nothing we saw lets us size it. What matters is not its size but its address. It shares hosting, tooling and a development team with a criminal intrusion set, which is concrete evidence that financially motivated crime and information operations are converging inside a single actor.

Deepfake Fraud

Deepfake-enabled fraud was the high-volume, here-and-now monetization. Hoxhunt reported that around 40% of business email compromise emails now carry AI-generated content, up from a small share in 2023 [48]. Pindrop measured deepfake fraud attempts on contact centers rising about 1,300% from 2023 to 2024, from roughly one every two days to seven a day. Voice cloning is now cheap enough that a usable clone can be made from a few seconds of audio for under $20 [49]. We hold both percentages at moderate confidence, because each vendor counts deepfake activity in its own way and neither figure has an independent cross-check. The direction is anchored in the FBI's 2025 Internet Crime Report, which logged record fraud losses and named AI as a growing enabler of fraud and impersonation [50]. As enterprises deploy their own AI agents, prompt injection and abuse of over-permissioned agents are an emerging defensive concern that we assess is early-stage but rising.

~40%of business email compromise emails carry AI-generated contentHoxhunt · moderate confidence

~1,300%rise in deepfake fraud attempts on contact centers, 2023 to 2024Pindrop · moderate confidence

<$20for a usable voice clone from a few seconds of audioPindrop

Signed does not mean safe

Sector and Geography

Targeting concentrated where downtime is costly and where data and identity are dense. IBM's X-Force index found manufacturing the most-attacked industry for the fifth consecutive year at 27.7% of incidents, followed by finance and insurance, and recorded North America as the most-attacked region for the first time in six years at 29% of cases, up from 24% [52]. The same research reported a 44% rise in the exploitation of public-facing applications and intensifying supply-chain and identity-based attacks [53]. These line up with the technology-sector focus of China-nexus espionage in Section 2.

27.7%of incidents hit manufacturing, the most-attacked industry for the fifth consecutive yearIBM X-Force

29%of cases in North America, the most-attacked region for the first time in six years, up from 24%IBM X-Force

+44%rise in the exploitation of public-facing applicationsIBM X-Force

Cloud

The cloud was a front of its own, and the way attackers get into it changed sharply. Google's Cloud Threat Horizons report, published in March 2026 and covering the second half of 2025, found that unpatched third-party software was the primary entry vector in 44.5% of cloud compromises. That is up from 2.9% in the first half of 2025, while weak or absent credentials fell from 47.1% to 27.2%. Google reads the shift as the result of its own default credential protections closing the easier route, which pushed attackers onto unpatched applications running on public-facing infrastructure, and it recorded exploitation of newly disclosed flaws within about 48 hours [133][134].

Wiz reached a similar conclusion looking back over 2025, finding that roughly 80% of documented cloud intrusions started from well-known weaknesses, meaning unpatched vulnerabilities, exposed secrets, and misconfigurations rather than novel techniques [135]. As trend context, CrowdStrike recorded cloud-conscious intrusions up 37% across 2025, a 266% jump among state-nexus actors, with valid-account abuse behind 35% of cloud incidents [12]. Its hunting data extends that into our period from a different angle, recording cloud-conscious eCrime activity up 171% across the twelve months to 30 June 2026, as criminal operators went after cloud credentials, computing power, language models, and digital assets [152]. The two numbers are not points on one line. They count different populations, criminal operators in one case and all cloud-conscious intrusions in the other, over windows that overlap rather than follow each other. Read together they say the same thing from two directions: the cloud is now a routine destination rather than a specialist one. Figure 15 shows the entry-vector mix behind it.

Cloud entry vectors

In the cloud, unpatched software overtook weak credentials

Primary entry vector for cloud compromises. Source: Google Cloud Threat Horizons Report H1 2026.

Figure 15. How attackers first got into cloud environments, comparing the first and second halves of 2025. Unpatched third-party software overtook weak or absent credentials over that year (Google Cloud) [133][134].

~80%of documented cloud intrusions started from well-known weaknessesWiz, 2025

+37%cloud-conscious intrusions across 2025; +266% among state-nexus actorsCrowdStrike

+171%cloud-conscious eCrime activity in the twelve months to 30 June 2026CrowdStrike

SaaS Extortion

The defining supply-chain-adjacent story of the half-year was the ShinyHunters extortion campaign against software-as-a-service and CRM platforms, which exfiltrated data at scale from environments such as Salesforce and Microsoft 365 and produced what was reported as the largest education-sector breach on record against Instructure in May [55]. We assess that the concentration of corporate data in a handful of SaaS platforms has made third-party and identity compromise a force multiplier, where one set of stolen tokens can unlock many downstream victims.

The ShinyHunters campaign was broad and sustained. Across H1 2026, the group, part of the loose "Com" scene, stole and extorted data from a run of large platforms. They included the fintech lender Figure (about one million accounts), the Infinite Campus K-12 student system (more than 137,000 school-staff records taken via Salesforce), and the cruise operator Carnival (about six million people). It also breached Instructure's Canvas learning platform repeatedly over roughly eight months [73][74][72]. The common factor was stolen access to SaaS and CRM tenants, not malware on endpoints.

Fintech · Figure~1Maccounts

K-12 · Infinite Campus137,000+school-staff records, taken via Salesforce

Cruise · Carnival~6Mpeople

Education · Instructure~8 moof repeated Canvas breaches

A defining ShinyHunters technique was abuse of Salesforce Experience Cloud. The group repurposed a modified copy of Mandiant's AuraInspector tool to mass-scan public sites and query backend CRM objects through over-permissioned guest-user settings. That is a customer configuration weakness rather than a platform flaw. The group claimed around 400 affected organizations [112].

Salesforce Experience Cloud

A configuration weakness, scanned at scale

ToolModified copy of Mandiant’s AuraInspector

ScanPublic Salesforce Experience Cloud sites, mass-scanned

QueryBackend CRM objects through over-permissioned guest-user settingsA customer configuration weakness, not a platform flaw

ClaimAround 400 affected organizations

The same actor reached the public sector. In late March the European Commission disclosed that data were taken from its Europa web-hosting cloud [103][104]. CERT-EU later set out the detail. Initial access came through a compromised AWS credential, and roughly 91.7 GB was exfiltrated and published by ShinyHunters on 28 March. Up to 71 Europa hosting clients were affected, among them 42 Commission entities and at least 29 other EU bodies. That is where the widely quoted figure of about 30 EU entities comes from. CERT-EU attributed the intrusion itself to TeamPCP and traced it to the Commission's unwitting use of a trojanized Trivy build, the same supply-chain wave described below, while attributing the leak of the data to ShinyHunters [151].

91.7 GBexfiltrated from the Europa web-hosting cloud and published on 28 MarchCERT-EU

European Commission, Europa cloud

The leak reached at least 29 EU bodies beyond the Commission

Source: CERT-EU, as cited in the text.

Open-Source Supply Chain

A parallel and fast-growing threat hit the open-source software supply chain, and the defining example was the self-propagating Shai-Hulud worm lineage. The original Shai-Hulud worm appeared in npm in September 2025. In 2026 the group TeamPCP, tracked as UNC6780, turned it into Mini Shai-Hulud, building on a March 2026 compromise of the Trivy scanner's ecosystem, the self-spreading CanisterWorm [80]. On 11 May 2026 the worm poisoned the TanStack package tree and spread to packages linked to Mistral AI, UiPath, OpenSearch, and Guardrails AI [97]. Crucially, this wave did not begin with a stolen npm token. It hijacked the legitimate release workflow through GitHub Actions CI cache poisoning and npm's OIDC trusted-publishing endpoint, so the malicious packages carried valid provenance attestations [94][96]. A package can therefore be cryptographically signed and still be malicious once the publisher's identity plane is compromised.

The lineage then mutated into the Miasma wave. On 1 June 2026 it hit Red Hat's @redhat-cloud-services npm namespace, with at least 32 tampered releases that added live cloud-identity collectors on top of credential theft. It soon reached Microsoft-linked GitHub repositories, where a compromised contributor account led GitHub to disable dozens of repositories under Azure/durabletask. That wave also planted files that execute when a developer merely opens the repository in an AI coding tool such as Claude Code, Gemini CLI, Cursor, or VS Code, moving the trigger from package-install to editor-open [95][96]. These worms were self-propagating by design [81].

One worm lineage across the npm supply chain

The self-propagating lineage tracked to TeamPCP, September 2025 into June 2026

September 2025Shai-Huludnpm worm
March 2026CanisterWormTrivy ecosystem
11 May 2026Mini Shai-HuludTanStack; valid provenance
1 June 2026MiasmaRed Hat npm, then Microsoft repositories

Each wave reused the previous one’s self-propagating code. By the third, the operators were hijacking the publishing identity itself, so malicious packages carried valid provenance attestations. Signed does not mean safe.

Source: Akamai, Wiz, StepSecurity and The Hacker News reporting.

Figure 16. One self-propagating worm lineage ran through the npm ecosystem from September 2025 into June 2026 [80][94][95][96][97].

The concentration in one ecosystem is itself a finding: 87% of the software-registry threats CrowdStrike identified in the first half of 2026 involved npm packages [152]. Two H1 2026 cases show the tempo and the reach. The eCrime actor CrowdStrike tracks as ALTERED SPIDER compromised more than 300 software dependencies in a single day, harvested credentials and pivoted into cloud environments. In June the DPRK-nexus actor it tracks as STARDUST CHOLLIMA injected a malicious dependency into at least 131 packages of the Mastra AI framework, which puts a state program in the same supply chain as the criminal waves above and points it at AI tooling specifically [152].

Software-registry threats, H1 2026

Nearly nine in ten registry threats targeted npm

Source: CrowdStrike 2026 Threat Hunting Report.

300+software dependencies compromised by ALTERED SPIDER in a single dayCrowdStrike

131+Mastra AI framework packages injected by STARDUST CHOLLIMACrowdStrike

Those two were not isolated cases. Across the half-year, attackers also hijacked the widely used Axios package to drop a cross-platform remote-access trojan, and abused the nx build tool to reach AWS administrative access within 72 hours, the activity tracked as UNC6426. They ran multi-registry credential-theft campaigns too, such as TrapDoor across npm, PyPI, and crates.io [82][83][84]. We assess open-source supply-chain compromise is now a mainstream initial-access and credential-theft vector, and that valid provenance and signatures can no longer be treated as proof of safety. Figure 16 traces the lineage from one wave to the next.

Axios · cross-platform RATnx · AWS admin in 72 hoursTrapDoor · npm, PyPI, crates.io

Regional Incidents

Geographically, disclosure was densest in North America and Europe, but the activity was global. In Europe, Italy said it foiled Russia-origin attacks on its foreign-ministry portals, a Washington embassy, and Milano-Cortina Winter Olympics sites just before the Games opened [105]. In the Middle East, the UAE reported foiling organized, partly AI-built attacks on vital sectors in February, while a June cyberattack disrupted shared infrastructure at four major Iranian banks [110][106]. In Africa, where English-language disclosure understates real exposure, South Africa's statistics agency confirmed a ransomware breach of a job-seeker HR database [111]. By sector, healthcare and finance recurred beyond ransomware: Novo Nordisk disclosed that pseudonymized clinical-trial patient data had been copied [107]. The sanctioned, Russia-linked exchange Grinex suspended operations after a roughly $13 to 15 million crypto theft [113].

Europe

Italy

Foiled Russia-origin attacks on foreign-ministry portals, a Washington embassy and Milano-Cortina Winter Olympics sites.

Middle East

UAE and Iran

The UAE reported foiling partly AI-built attacks; a June cyberattack disrupted four major Iranian banks.

Africa

South Africa

Stats SA confirmed a ransomware breach of a job-seeker HR database.

Faster reporting, risk-based remediation

Defensive and regulatory developments

Three jurisdictions, one direction: faster, mandatory reporting

United States

European Union

United Kingdom

Instrument

CISA BOD 26-04

Cyber Resilience Act

Cyber Security and Resilience Bill

Status

●issued 10 June 2026

●in force; reporting from 11 Sep 2026

○proposed, report stage

Binds

federal civilian agencies

manufacturers of products

would cover more sectors and their supply chains

Clock

3 days for flaws meeting all four criteria

24 h early warning, 72 h notification

24 h initial, 72 h full (proposed)

Next date

—

main obligations 11 Dec 2027

phased toward 2028

As reported in the text.

Two defensive shifts in H1 2026 matter beyond their home jurisdictions. In the United States, CISA issued Binding Operational Directive 26-04, "Prioritizing Security Updates Based on Risk", on 10 June 2026. It moves federal civilian agencies from fixed patch windows to risk-based remediation across four criteria, asset exposure, known-exploited status, exploit automation, and post-exploitation impact, and it imposes a three-day deadline to remediate, plus forensic triage, for a vulnerability that meets all four [62]. The directive is federal in scope, but the pressure behind it is not. Automated and AI-enabled exploitation has compressed the window between disclosure and weaponization to days. The Check Point VPN response, in which CISA ordered a three-day fix, is a preview of the new normal.

BOD 26-04

Four criteria. When all four are met, three days.

Asset exposure

Known-exploited status

Exploit automation

Post-exploitation impact

All four metThree days to remediate, plus forensic triage

In the European Union, the Cyber Resilience Act continued moving from law into practice. It entered into force in December 2024. Manufacturer duties to report actively exploited vulnerabilities and severe incidents apply from 11 September 2026, on a 24-hour early warning followed by a 72-hour full notification, and the main product obligations apply from 11 December 2027 [102]. For a threat-landscape view the significance is that mandatory product-security and reporting duties are arriving for the software and hardware vendors that sit upstream of thousands of downstream organizations, exactly the trust-chain layer that the supply-chain attacks in Section 8 abused.

EU Cyber Resilience Act

From law into practice

December 2024Entered into force
11 September 2026Manufacturer reporting duties apply24-hour early warning, then a 72-hour full notification
11 December 2027Main product obligations apply

The United Kingdom advanced its Cyber Security and Resilience Bill, introduced in November 2025 and at report stage in Parliament by June 2026. It would expand the network-and-information-systems regime to more sectors and their supply chains and tighten incident reporting to a 24-hour initial and 72-hour full notification, with phased implementation toward 2028 [114]. These duties are proposed rather than current law, since the bill was still in passage, so nothing in it binds organizations yet. Taken together, the US, EU, and UK moves point the same way: faster mandatory reporting and risk-based, supply-chain-aware regulation.

Expectations, not forecasts

What follows is not a forecast. These are expectations drawn from the evidence in this report, and any of them could be overtaken by a takedown, a new vulnerability class, or a shift in the criminal market.

Ransomware

Ransomware victim volumes are likely to stay near record levels, with impact still concentrated in a few groups even as the number of active operations grows.

Extortion

Encryption-free data-theft extortion is likely to grow for as long as payment rates stay low.

Access

Exploitation of internet-facing devices, and of identity, is likely to remain the leading access route, and MFA based on one-time codes could well keep being bypassed by adversary-in-the-middle kits and help-desk social engineering, which would sustain demand for phishing-resistant authentication.

Social engineering

ClickFix-style social engineering could remain dominant for initial access into 2027, although commodity techniques are also displaced quickly once defenders adapt.

AI

More incidents involving autonomous agent collectives may be disclosed following the July 2026 cases, and deepfake-enabled fraud is likely to keep rising.

Hacktivism and OT

Hacktivist targeting of exposed OT interfaces could increase around active conflicts, while probably staying opportunistic.

State activity

State activity from China and North Korea could well continue at or above current levels, the former focused on internet-facing devices and telecom espionage, the latter on revenue.

Identity and the internet edge first

Close internet-facing exposure, and treat it as one half of the problem rather than the whole of it. Inventory all internet-facing appliances, VPNs, and management interfaces; track CISA KEV additions and patch edge devices on a days, not weeks, cadence; and retire unsupported devices. This addresses one of the two leading access routes in Sections 2, 4 and 5. The identity half follows in the next two priorities.
Move to phishing-resistant authentication. Adopt FIDO2 or passkeys for privileged and remote access, bind sessions to devices to blunt cookie replay, and shorten session lifetimes. This counters the AiTM and ClickFix activity in Section 5.
Harden the help desk and account recovery. Require strong identity proofing for password and MFA resets, add call-back verification, and monitor for recovery-channel abuse. This counters the Scattered Spider pattern in Section 5.
Reduce infostealer impact. Block known stealer delivery, restrict script execution that enables ClickFix, monitor for stolen-credential and session-token reuse, and enforce conditional access. This addresses Sections 3 and 5.
Govern SaaS and third-party identity. Inventory OAuth grants and third-party app tokens, least-privilege them, and watch for mass data egress from SaaS and CRM platforms. This addresses the supply-chain exposure in Section 8.
Build ransomware resilience around the assumption of data theft. Maintain tested, offline backups, but plan for extortion that relies on publication rather than encryption, including legal and communications playbooks. This addresses Section 1.
Prepare for AI-enabled operations. Update awareness training for deepfake voice and video, add verification steps for high-value financial and access requests, and govern internal AI agents with least privilege and input isolation. This addresses Section 7.

Notable incidents, vulnerabilities and sources

Figure 17. Selected incidents across the first half of 2026; the full list with sources follows below.

Selected incidents, January to June 2026

A curated timeline; the full list with sources follows

January

Kimwolf botnet built from Android TV boxes
Target source code stolen

February

Italy foils Olympics-linked attacks
Epic health record system offline at a US medical center

March

CanisterWorm hits npm via Trivy
European Commission Europa cloud breach

April

Germany names the REvil and GandCrab leader

May

The Gentlemen leak their own backend (4 May)
Mini Shai-Hulud poisons TanStack (11 May)
First VPN seized; Kimwolf operator arrested

June

Miasma hits Red Hat npm (1 June)
CISA issues BOD 26-04; PeopleSoft zero-day extortion

January 2026: the Kimwolf botnet was assembled from compromised Android TV boxes and grew past two million devices; the BreachForums criminal forum was breached (about 324,000 individuals); the Illinois and Minnesota human-services departments reported a breach affecting roughly 1 million people; and Target reported theft of internal source code [63][54][56].
February 2026: ShinyHunters posted data from the fintech lender Figure (about 1 million accounts); a ransomware attack took the University of Mississippi Medical Center's Epic electronic health record system offline across 35 clinics; and NYC Health and Hospitals disclosed an intrusion (late November 2025 to February 2026) in which attackers took biometric fingerprints and palm prints, affecting at least 1.8 million people. Italy said it foiled Russia-origin attacks on Winter Olympics and foreign-ministry sites on 4 February, and the UAE reported foiling AI-assisted attacks on vital sectors [73][89][54][105][110].
March 2026: Iran-aligned actors claimed a wiper attack on medical-technology firm Stryker; ShinyHunters stole more than 137,000 school-staff records from the Infinite Campus system; and the self-spreading CanisterWorm hit dozens of npm packages. The European Commission disclosed a breach of its Europa web-hosting cloud (data later published by ShinyHunters), ShinyHunters mass-scanned Salesforce Experience Cloud with a modified AuraInspector, and South Africa's Stats SA confirmed an HR-database ransomware breach [71][80][103][112][111].
April 2026: ShinyHunters breached the cruise operator Carnival (about 6 million people); Germany unmasked the REvil and GandCrab leader "UNKN" as a 31-year-old Russian; and CISA was reported to be containing a leak of its own internal data. The sanctioned, Russia-linked exchange Grinex suspended operations after a roughly $13 to 15 million crypto theft [74][88][87][113].
May 2026: Instructure's Canvas platform breach disrupted schools nationwide as part of the ShinyHunters SaaS campaign; authorities seized the First VPN service used by ransomware gangs; and Canadian and US authorities arrested the alleged Kimwolf botnet operator. The Mini Shai-Hulud worm also poisoned the TanStack npm tree (11 May), Google reported the first likely AI-developed zero-day, and The Gentlemen ransomware administrator acknowledged a leak of the group's own backend database (4 May) [72][85][63][94][100][120].
June 2026: the Miasma supply-chain wave hit Red Hat npm packages (1 June) and Microsoft-linked GitHub repositories; ShinyHunters exploited the Oracle PeopleSoft zero-day CVE-2026-35273 against higher education (Google notified 100+ organizations); Check Point disclosed the actively exploited VPN flaw CVE-2026-50751; Google detailed the UNC6508 medical-research espionage campaign; and CISA issued Binding Operational Directive 26-04. Check Point and PRODAFT profiled The Gentlemen ransomware operation and tied its administrator to a named Russian national, and Symantec disclosed DragonForce abusing Microsoft Teams relays to hide command-and-control traffic. A cyberattack also disrupted four major Iranian banks, Novo Nordisk disclosed copied clinical-trial data, Meta's AI support chatbot was abused to hijack 20,225 Instagram accounts, and Google sued the Gemini-abusing Outsider phishing operation [95][90][92][98][62][115][116] [117][121][106][107][109][108].
June 2026, unverified claims: several outlets reported claims of a large US government data exposure and intrusions into utility and federal systems. We treat these as low confidence because they rest on single-source, politically charged framing, and we recommend corroboration before any use [54].
17 to 18 June 2026: researchers disclosed the FortiBleed dataset, exposing valid credentials for 73,932 internet-facing Fortinet firewall URLs, about half of all such devices. Its origin is unverified, and we cover it in Section 4 [124][125].

13. Appendix B: Selected Exploited Vulnerabilities

CVE-2025-61882, Oracle E-Business Suite, critical unauthenticated remote code execution, mass-exploited by Cl0p [8].
CVE-2026-35273, Oracle PeopleSoft (PSEMHUB), critical unauthenticated remote code execution, exploited as a zero-day by ShinyHunters/UNC6240 against higher education [90].
CVE-2026-50751, Check Point Remote Access VPN (IKEv1), authentication bypass, exploited from early May 2026 and linked to a Qilin affiliate [92].
CVE-2026-1340, Ivanti Endpoint Manager Mobile, critical unauthenticated remote code execution, reported actively exploited [26].
CVE-2026-21509, Microsoft Office, security feature bypass in RTF handling, patched out of band on 26 January 2026 after active exploitation by APT28 in Operation Neusploit [66].
CVE-2026-31431, Linux, local privilege escalation, exploited in April 2026 by the Belarus-nexus actor CrowdStrike tracks as UMBRAL BISON, with the activity uncovered just over 20 hours after disclosure [152].
CVE-2026-24858, FortiOS and FortiGate, critical authentication bypass via FortiCloud SSO, exploited before disclosure [27].
CVE-2024-55591, FortiOS, authentication bypass in the management interface, used by The Gentlemen for edge access [115].
CVE-2025-32433, Erlang and OTP SSH, unauthenticated remote code execution, used by The Gentlemen [115].
CVE-2025-33073, Windows NTLM reflection and relay, privilege escalation, used by The Gentlemen for lateral movement [115].
CVE-2023-52271, CVE-2025-61155, and CVE-2025-1055, vulnerable Windows drivers abused in DragonForce bring-your-own-vulnerable-driver attacks to disable endpoint protection [122].
2024 baseline edge flaws still relevant: CVE-2024-3400 (PAN-OS GlobalProtect); CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure); CVE-2023-48788 (Fortinet FortiClient EMS) [27].

14. Abbreviations

AiTM, adversary-in-the-middle
APT, advanced persistent threat
BEC, business email compromise
BYOVD, bring your own vulnerable driver
CERT, computer emergency response team
CISA, Cybersecurity and Infrastructure Security Agency
CVE, common vulnerabilities and exposures
DDoS, distributed denial of service
DLS, data-leak site
EDR, endpoint detection and response
KEV, known exploited vulnerabilities
MFA, multi-factor authentication
ODNI, Office of the Director of National Intelligence
OT, operational technology
PhaaS, phishing as a service
RaaS, ransomware as a service
RAT, remote access trojan
SaaS, software as a service
SCADA, supervisory control and data acquisition
Tbps, terabits per second

15. References

Read the research behind this report

Two of the investigations cited here were published by VMRay Labs in full.

VMRay Labs · 20 July 2026

Operation STANDOFF: execution-level analysis of a Russian-speaking multi-operator intrusion campaign

VMRay Labs · 30 June 2026

UniqueSignal (NEW!)

DeepResponse

Professional Services

TotalInsight

FinalVerdict

Analyzer (Legacy)

Use Cases

Industry

Success Stories

By Category

By Company

Why VMRay

News

About Us & Contact

Careers

Insights

Malware Analysis Reports

Cybersecurity glossary

Same threats, larger scale, faster tempo.

Tracked Malware Families

Most Relevant Malware Families

Share of extracted malware configurations, by family

Key Judgments

Volume and Concentration

Victim counts stayed near record levels through both quarters

The count of active groups fell in the first quarter, then rose to a record in the second

A new group went from 40 victims to overtaking the leader within three quarters

The Gentlemen

Edge-first tradecraft, from appliance to encryptor

A chain of reused credentials ran from a forum address to a real name

Payment Economics

Fewer payments, larger sums: both datasets move in two directions at once

Application Zero-Days and Mass Extortion

One internet-facing application flaw, mass exploitation, extortion at scale

Law Enforcement

Takedowns dent capacity; rebrands bring it back

Healthcare

Five state nexuses, three motives

Logistics targeting grew more than twice as fast as China-nexus activity overall

Salt and Volt Typhoon

Singapore’s telecom sector

WinRAR flaw used to spy on government and law-enforcement bodies across Southeast Asia

Kept access into South American telecoms

Go-language backdoors on a dozen Mongolian government systems

Quiet collection through the victims’ own mail rules

Russia and Belarus

From insecure routers to Microsoft 365 credentials

Most early activity around a new flaw is experimentation, not compromise

North Korea and Iran

One theft made up most of North Korea’s 2025 crypto haul

Infostealers

Harvested data becomes logs, and the logs feed access brokers and extortion

Vidar took most of the market as Lumma fell away

Share of samples shared to the public corpus, by family

Remote-Access Tooling

Growth in activity across 2025, by category

Change between Q4 2025 and Q1 2026, by malware type

A DocuSign lure, a fake DirectX installer, an injected payload

Where Command-and-Control is Moving

Ten routes to one contract, so blocking any single endpoint fails

The same technique, delivered by Vidar

Crypting and loading sold as a service

Evasion

Malware-free detections rose from 51% to 82% of the total

Chained vulnerable drivers before the locker

Defenders saw Microsoft traffic; underneath ran a command channel

Operation STANDOFF

No static indicator tied the dropper to the operator platform. Execution did.

Four capabilities on one body of infrastructure

Firewalls

VPN gateways

Mail and file-transfer appliances

Remote-access portals

Management interfaces

Exploitation Timeframe

Two clocks, one acceleration

Annual Baselines

Up 15% on 2024, below the 2023 record

Microsoft led with 25

Nearly half hit enterprise software