IBM X-Force 2026 Index Finds Rising Exploitation and Supply-Chain Compromises
Summary
IBM X-Force’s 2026 index reports a 44% rise in public-facing app exploitation, nearly 4x more supply-chain compromises since 2020, and 300,000+ ChatGPT credentials advertised on dark-web markets; exploitation accounted for 40% of incidents.
Key points
- IBM X-Force tracked a 44% year-over-year increase in attacks beginning with exploitation of public-facing applications.
- Vulnerability exploitation accounted for 40% of incidents X-Force responded to in 2025; 56% of exploited vulnerabilities required no authentication.
- More than 300,000 ChatGPT credential sets were advertised on dark-web markets, reportedly harvested by Raccoon and Vidar infostealers.
- X-Force counted 109 ransomware and extortion groups in 2025, up from 73 in 2024, with activity spread across a longer tail of groups.
- Supply-chain compromises nearly quadrupled since 2020; the article describes risks involving CI/CD pipelines, trusted developer identities, and unvetted dependencies.
- The report says attackers use AI to accelerate vulnerability discovery, reconnaissance, phishing, and payload adaptation; AI coding assistants may also speed the introduction of unvetted dependencies.
- Manufacturing accounted for 27.7% of observed incidents, while North America represented 29% of attacks and was the most-targeted region for the first time in six years.
Article Details
- Publisher
- IBM X-Force
- Report Period
- 2025 (2026 Threat Intelligence Index)
- Scope
- Threat activity and vulnerabilities tracked by X-Force, with comparisons to 2020 and 2024 where stated.
- Sample Size
- Nearly 40,000 vulnerabilities tracked during 2025.
- Key Statistics
- Attacks beginning with exploitation of public-facing applications increased 44% year over year; vulnerability exploitation accounted for 40% of incidents X-Force responded to in 2025.
- 56% of exploited vulnerabilities tracked in 2025 required no authentication.
- More than 300,000 ChatGPT credential sets were advertised on dark-web markets.
- X-Force counted 109 ransomware and extortion groups in 2025, up from 73 in 2024 (a 49% increase).
- Supply chain compromises nearly quadrupled since 2020.
- Recommendations
- Include AI platforms in organizational credential monitoring.
MITRE ATT&CK
T1110.004 · Credential StuffingThe report describes credential stuffing exploiting password reuse between personal and enterprise accounts.T1190 · Exploit Public-Facing ApplicationThe report describes attacks beginning with exploitation of public-facing applications.T1195.002 · Compromise Software Supply ChainThe report describes supply chain compromises involving CI/CD pipelines, developer identities, and unvetted dependencies.T1566 · PhishingThe report says ransomware crews use AI to craft phishing lures.
People
Threat Actors
BabukThe article says leaked builder kits from Babuk helped other crews establish ransomware operations; it does not attribute those crews' operations to Babuk.LockBitThe article says leaked builder kits from LockBit helped other crews establish ransomware operations; it does not attribute those crews' operations to LockBit.