Cybersecurity Statistics for 2026 Highlight Credential Abuse, Ransomware and Security Gaps
Summary
Huntress compiles cybersecurity findings from industry reports and surveys, highlighting credential abuse, rising vulnerability exploitation, ransomware activity, slow remediation and security staffing shortages.
Key points
- A June 2025 Huntress survey of more than 500 US IT professionals found that 54% of organizations experienced malware attacks, 44% phishing or spearphishing, and 36% business email compromise in the preceding year.
- Verizon findings cited in the article identify credential abuse as the leading breach vector and vulnerability exploitation as the initial access method in one-fifth of breaches.
- According to the cited Verizon data, third-party involvement in breaches doubled from 15% to 30%; only 54% of edge-device vulnerabilities were fully remediated, with a median resolution time of 32 days.
- Huntress reports that RansomHub, Lynx and Akira were linked to more than half of its observed ransomware incidents, with an average time-to-ransom of approximately 17 hours.
- The ITRC recorded 3,158 compromises and more than 1.3 billion victim notices in 2024; 65% of notices lacked attack-vector details.
- IBM findings put the average global data breach cost at $4.88 million in 2024, up 10% from 2023, with downtime, customer support and remediation driving the increase.
- ISC2 findings indicate that two-thirds of surveyed cybersecurity decision-makers faced staffing shortages, while 54% of cybersecurity professionals reported privacy and security problems associated with organizational generative AI adoption.
Article Details
- Publisher
- Huntress
- Report Period
- Primarily 2024 observations, supplemented by 2025 survey findings
- Scope
- Compilation of cybersecurity statistics covering attacks, breaches, identity threats, ransomware, costs, workforce, AI, and sector-specific risks.
- Sample Size
- Multiple source populations; the June 2025 Huntress survey included more than 500 US IT professionals.
- Key Statistics
- In Huntress's June 2025 survey of more than 500 US IT professionals, 54% reported organizational malware attacks in the preceding 12 months, 44% reported phishing or spearphishing, and 36% reported business email compromise.
- Huntress reported that exploitation targeting ScreenConnect vulnerabilities CVE-2024-1709 and CVE-2024-1708 accounted for two-thirds of its identified traditional exploitation attempts in 2024.
- ITRC reported 3,158 compromises and more than 1.3 billion victim notices in 2024; victim notices increased 211% compared with 2023.
- IBM estimated the average global data breach cost at $4.88 million in 2024, a 10% increase from 2023.
- The article cites Verizon figures stating that ransomware involved 39% of all breaches and 88% of breaches affecting small and medium-sized businesses.
- Recommendations
- Use MFA or passkeys to help prevent credential-stuffing attacks.
MITRE ATT&CK
T1047 · Windows Management InstrumentationWMI was explicitly identified among utilities involved in scripting abuse.T1059.001 · PowerShellPowerShell accounted for 45% of scripting-language use across scenarios monitored by Huntress in 2024; malicious PowerShell scripts also affected government organizations.T1059.007 · JavaScriptThe article describes malicious JavaScript scripts used against government organizations in 2024.T1110.004 · Credential StuffingThe article cites ITRC reporting at least 29 credential-stuffing attacks using compromised logins and passwords.T1218.005 · MshtaMSHTA was explicitly identified among utilities involved in scripting abuse.T1547.001 · Registry Run Keys / Startup FolderRegistry Run Keys were the leading persistence method, appearing in almost half of Huntress's identified cases.T1564.008 · Email Hiding RulesMalicious Inbox Rule modifications moved messages into RSS Feeds and Conversation History folders.T1566 · PhishingObserved phishing included e-signature impersonation, QR codes, and emails impersonating Microsoft and DocuSign.
CVE
CVE-2024-1708In 2024, the most active campaign identified by Huntress targeted vulnerabilities CVE-2024-1709 and CVE-2024-1708 in ScreenConnect, representing two-thirds of identified traditional exploitation attempts.CVE-2024-1709In 2024, the most active campaign identified by Huntress targeted vulnerabilities CVE-2024-1709 and CVE-2024-1708 in ScreenConnect, representing two-thirds of identified traditional exploitation attempts.
People
Malware
AkiraOver half of the ransomware incidents were linked to RansomHub, Lynx, and Akira.AsyncRATRemote access trojans (RATs) like AsyncRAT and Jupyter were used in over 75% of observed remote access attacks.JupyterRemote access trojans (RATs) like AsyncRAT and Jupyter were used in over 75% of observed remote access attacks.LynxOver half of the ransomware incidents were linked to RansomHub, Lynx, and Akira.NetSupport RATManufacturing environments saw high numbers of RAT installations in 2024, with AsyncRAT, Trickbot, NetSupport, and NewCoreRAT as the most frequently detected families.NewCoreRATManufacturing environments saw high numbers of RAT installations in 2024, with AsyncRAT, Trickbot, NetSupport, and NewCoreRAT as the most frequently detected families.RansomHubOver half of the ransomware incidents were linked to RansomHub, Lynx, and Akira.SocGholishIn 2024, the main attack on government organizations was mainly malicious scripts built on PowerShell and JavaScript, often connected to SOCGholish and AsyncRAT.TrickBotManufacturing environments saw high numbers of RAT installations in 2024, with AsyncRAT, Trickbot, NetSupport, and NewCoreRAT as the most frequently detected families.
Products
NordVPNNordVPN was the most common VPN used for abuse, making up 20% of all incidents identified.ScreenConnectIn 2024, the most active campaign identified by Huntress targeted vulnerabilities CVE-2024-1709 and CVE-2024-1708 in ScreenConnect, representing two-thirds of identified traditional exploitation attempts.
Tools
AD ExplorerPSExec, AD Explorer, and SDelete were the most frequently used Sysinternals tools by attackers in 2024.BloodHoundHacking tools like Cobalt Strike and BloodHound were used more often against government entities than other industries.Cobalt StrikeCobalt Strike is still the most prevalent hacking tool, used for over 31% of hacks in 2024.MimikatzMimikatz and generic malware were the top tools for gaining access to system credentials, together making up 55%.mshta.exeScripting abuse incidents involved MSHTA, WMI, and WScript in 8.4% of cases.PsExecPSExec, AD Explorer, and SDelete were the most frequently used Sysinternals tools by attackers in 2024.SDeletePSExec, AD Explorer, and SDelete were the most frequently used Sysinternals tools by attackers in 2024.Windows Management InstrumentationScripting abuse incidents involved MSHTA, WMI, and WScript in 8.4% of cases.WScriptScripting abuse incidents involved MSHTA, WMI, and WScript in 8.4% of cases.
Countries
Industries
EducationCybersecurity in education statisticsfinanceSome industries are shiny temptations that threat actors just can't resist (ahem, finance), while others might seem a little less exciting, but still hold plenty of valuable info.Healthcare34% of healthcare IT professionals say financial loss has the biggest impact after a cyber threat.ManufacturingCybersecurity in manufacturing statisticsState and local governmentCybersecurity in state and local government statistics