ThreatDown 2026 Malware Report Tracks Ransomware Growth and AI-Assisted Attacks
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
ThreatDown reports an 8% rise in known ransomware attacks in 2025 and says 86% of observed encryption attacks operated remotely. Its annual report examines stealthy intrusions, security blind spots, and emerging AI-assisted attacks.
Key points
- Known ransomware attacks increased 8% in 2025 and affected 135 countries, according to the report's leak-site-based analysis; the United States accounted for 48% of recorded events.
- ThreatDown says hands-on intrusions relied heavily on legitimate tools and stolen credentials, with phishing and vulnerabilities in internet-facing Fortinet and SonicWall appliances prominent initial-access methods.
- ThreatDown reports that 86% of observed encryption attacks were conducted remotely, often from unprotected systems, limiting protected endpoints' ability to quarantine the source.
- Attackers compressed operations into hours, worked during nights and weekends, and targeted security tools and recovery mechanisms, including through vulnerable drivers and backup deletion.
- The report cites Anthropic's accounts of AI-assisted extortion and MCP-enabled intrusion campaigns, while noting researchers' skepticism about some autonomous-attack claims.
- ThreatDown forecasts broader AI-driven attacks in 2026 and recommends closing monitoring gaps, hardening identities, accelerating patching, and maintaining continuous detection and response.
Article Details
- Publisher
- ThreatDown
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global ransomware leak-site activity, ThreatDown MDR intrusion observations, and reported developments in AI-enabled cybercrime.
- Key Statistics
- Known ransomware attacks increased 8% year over year in 2025; the report describes dark-web leak sites as its principal view of ransomware activity, rather than independently confirmed incidents.
- ThreatDown reports that 86% of encryption attacks in 2025 were conducted remotely.
- The United States accounted for 48% of known ransomware events in the report's 2025 country distribution.
- Akira accounted for 37% of ransomware attacks detected by ThreatDown MDR in 2025.
- A cited IBM analysis found AI involvement in 16% of breaches, with deepfake voice or video manipulation accounting for 35% of those AI-related incidents.
- Recommendations
- Accelerate vulnerability assessment, patching, and remediation of internet-facing systems.
- Identify unmanaged systems and close endpoint monitoring blind spots.
- Harden identity systems and reduce the attack surface.
- Maintain continuous monitoring and response coverage, including nights, weekends, and holidays.
- Use overlapping prevention, detection, endpoint isolation, and recovery controls across the attack lifecycle.
MITRE ATT&CK
T1003 · OS Credential DumpingMimikatz was described as extracting credentials from memory to support escalation and lateral movement.T1021.002 · SMB/Windows Admin SharesAttackers used PsExec for remote execution and to launch encryption from other systems.T1046 · Network Service DiscoveryNetwork Service Discovery was the most frequently detected technique in ThreatDown MDR's reported 2025 technique distribution.T1047 · Windows Management InstrumentationAttackers used Windows Management Instrumentation to execute commands across compromised environments.T1059.001 · PowerShellAttackers executed PowerShell commands during lateral movement.T1068 · Exploitation for Privilege EscalationAttackers exploited software vulnerabilities to escalate from standard user privileges to SYSTEM-level access.T1070.001 · Clear Windows Event LogsAttackers cleared Windows event logs to conceal activity and impede incident investigation.T1078 · Valid AccountsAttackers used stolen credentials to access systems and support subsequent intrusion activity.T1134 · Access Token ManipulationAttackers abused Windows token impersonation to act as SYSTEM without stealing credentials.T1219 · Remote Access ToolsAttackers used legitimate remote monitoring and management software, including ConnectWise and AnyDesk, for persistent remote access.T1486 · Data Encrypted for ImpactAttackers encrypted organizational data and demanded payment for decryption; the report also describes remote encryption from unprotected systems.T1490 · Inhibit System RecoveryBefore encryption, attackers deleted shadow copies, purged cloud snapshots, or disabled backups to undermine recovery.T1562.001 · Disable or Modify ToolsAttackers targeted EDR protection, including using legitimately signed vulnerable drivers to gain kernel privileges and disable defenses.T1566 · PhishingThreatDown observed phishing for initial access, including fake document-download lures and credential-harvesting login pages.T1567.002 · Exfiltration to Cloud StorageAttackers exfiltrated data to cloud storage platforms such as Google Drive, OneDrive, and Dropbox.
People
Efi WeissCreator of Auto Exploit, an AI-driven exploit pipeline described as generating proof-of-concept code in as little as 15 minutes.Nico WaismanXBOW CISO quoted describing an autonomous penetration tester reaching the top of the US bug bounty leaderboard.Sam AltmanOpenAI CEO quoted warning that generative AI had defeated face and voice authentication used by banks.
Threat Actors
AkiraIdentified as the second most active ransomware group of 2025; targets small and mid-sized organizations using unpatched VPNs and stolen credentials.Cl0pDescribed as conducting high-impact mass exploitation of file-transfer and data-movement systems using zero-day vulnerabilities, primarily for data theft.DragonForceListed in both global ransomware activity and ThreatDown MDR ransomware detection distributions for 2025.GTG-1002Anthropic's tracking designation for an operation reportedly using Claude Code and MCP-enabled tooling across 30 organizations; the report notes researcher skepticism about Anthropic's claims.GTG-2002Anthropic's tracking designation for an extortion operation attributed to a single criminal using Claude Code for reconnaissance, credential harvesting, intrusion, stolen-data analysis, and tailored extortion.INC RansomDescribed as nearly doubling its activity in 2025, with an expanding affiliate model and attacks using compromised credentials.PlayListed as responsible for 5% of the report's 2025 ransomware activity distribution.QilinIdentified as the most active ransomware group of 2025; targets mid-sized organizations using encryption, data theft, unpatched remote-access appliances, and credential harvesting.RansomHubListed in the 2025 ransomware activity distribution; its fragmentation is cited as a possible contributor to Qilin's rise.SafepayListed as responsible for 4% of the report's 2025 ransomware activity distribution.
Malware
Vendors
AnthropicEight months later, the first signs of that shift appeared in Anthropic’s August 2025 Threat Intelligence report, which detailed an extortion campaign (GTG-2002) where a single criminal used Claude Code to automate andFortinetwere phishing (T1566), and software vulnerabilities in internet-facing security appliances—particularly Fortinet firewalls and SonicWall VPNs (T0819).SonicWalland software vulnerabilities in internet-facing security appliances—particularly Fortinet firewalls and SonicWall VPNs (T0819).ThreatDown> — *ThreatDown Threat Research Analyst*
Products
AnyDeskRMM tools like ConnectWise and AnyDesk provide full keyboard access and do not look out of place on corporate networks.Claude CodeIntelligence report, which detailed an extortion campaign (GTG-2002) where a single criminal used Claude Code to automate and scale attacks against targets in healthcare, defense, emergency services, and localConnectWiseRMM tools like ConnectWise and AnyDesk provide full keyboard access and do not look out of place on corporate networks.ESXi- **ESXi hypervisors**ThreatDown Endpoint Detection & Response (EDR)The ThreatDown Endpoint Detection & Response (EDR) platform detects and blocks threats with advanced layers of protection, persistent ransomware rollback, and deep malware cleanup.ThreatDown MDR![Chart showing Top 10 MITRE ATT&CK Tactics detected by ThreatDown MDR in 2025]
Tools
Auto ExploitIn 2025, vulnerability research reached a turning point as AI systems like Google’s Big Sleep, XBOW, and Auto Exploit—a publicly demonstrated AI-driven exploit pipeline—began to outperform human experts.Big SleepIn 2025, vulnerability research reached a turning point as AI systems like Google’s Big Sleep, XBOW, and Auto Exploit—a publicly demonstrated AI-driven exploit pipeline—began to outperform human experts.Cobalt StrikeT1021.002) or Remote Desktop Protocol (MITRE T1021.001), or deploy post-exploitation frameworks like Cobalt Strike or Metasploit to automate movement.LaZagneMimikatz (MITRE S0002) extracts credentials from memory (MITRE T1003), while LaZagne (MITRE S0349) retrieves passwords stored locally on compromised systems (MITRE T1555).Metasploit FrameworkRemote Desktop Protocol (MITRE T1021.001), or deploy post-exploitation frameworks like Cobalt Strike or Metasploit to automate movement.MimikatzMimikatz (MITRE S0002) extracts credentials from memory (MITRE T1003), while LaZagne (MITRE S0349) retrieves passwords stored locally on compromised systems (MITRE T1555).Mythic2025 saw a rapid progression in AI-driven red teaming as researchers used MCP to bind AI agents to individual tools like nmap and then to fully featured red-team frameworks such as Mythic.Nmap2025 saw a rapid progression in AI-driven red teaming as researchers used MCP to bind AI agents to individual tools like nmap and then to fully featured red-team frameworks such as Mythic.PsExecor Windows Management Instrumentation (MITRE T1047), pivot using built-in remote access such as PsExec (MITRE T1021.002) or Remote Desktop Protocol (MITRE T1021.001), or deploy post-exploitation frameworksXBOWIn 2025, vulnerability research reached a turning point as AI systems like Google’s Big Sleep, XBOW, and Auto Exploit—a publicly demonstrated AI-driven exploit pipeline—began to outperform human experts.
Countries
Brazila cyberattack brought Jaguar Land Rover’s (JLR) auto production in the UK, China, Slovakia, India, and Brazil to a halt for five weeks, costing JLR an estimated $50 million a week.[^8] The attack affected 5,000Canadawas forced to temporarily shut down steel mills, recycling centers, and fabrication plants in the US, Canada, and Mexico in May 2025, after it detected unauthorized third-party access to some of its systems.ChinaIn August 2025, a cyberattack brought Jaguar Land Rover’s (JLR) auto production in the UK, China, Slovakia, India, and Brazil to a halt for five weeks, costing JLR an estimated $50 million a week.[^8] The attackFrance- **3%** FranceGermany- **5%** GermanyIndiaAugust 2025, a cyberattack brought Jaguar Land Rover’s (JLR) auto production in the UK, China, Slovakia, India, and Brazil to a halt for five weeks, costing JLR an estimated $50 million a week.[^8] The attack affectedItaly- **2%** ItalySpain- **2%** SpainUnited Kingdom- **4%** United KingdomUnited States- **48%** United States
Industries
business servicesQilin targets mid-sized companies, regional firms, and local service providers across manufacturing, business services, healthcare, construction, and technology rather than large multinationals.ConstructionQilin targets mid-sized companies, regional firms, and local service providers across manufacturing, business services, healthcare, construction, and technology rather than large multinationals.Defense- **23.98%** Defense Evasion – TA0005Emergency Servicescriminal used Claude Code to automate and scale attacks against targets in healthcare, defense, emergency services, and local government.HealthcareQilin targets mid-sized companies, regional firms, and local service providers across manufacturing, business services, healthcare, construction, and technology rather than large multinationals.Local governmentCode to automate and scale attacks against targets in healthcare, defense, emergency services, and local government.ManufacturingQilin targets mid-sized companies, regional firms, and local service providers across manufacturing, business services, healthcare, construction, and technology rather than large multinationals.Technology#### Technology blackout across 14 hospitals