CrowdStrike 2026 Threat Report Finds Faster Intrusions and Rising AI-Enabled Attacks
Report discovered via Awesome Annual Security Reports.
Summary
CrowdStrike’s 2026 Global Threat Report says average eCrime breakout time fell to 29 minutes in 2025. Attacks by AI-enabled adversaries rose 89%, while threat actors increasingly abused trusted identities, cloud services, and unmanaged systems.
Key points
- CrowdStrike reports average eCrime breakout time reached 29 minutes in 2025, with the fastest observed breakout taking 27 seconds; 82% of detections were malware-free.
- Attacks by AI-enabled adversaries increased 89% year over year. The report says AI primarily enhanced established techniques rather than creating novel attack vectors.
- Cloud-conscious intrusions rose 37%, including a 266% increase among state-nexus actors; valid account abuse accounted for 35% of cloud incidents.
- CrowdStrike observed a 42% increase in zero-day vulnerabilities exploited before public disclosure, highlighting a shrinking opportunity for defenders to respond.
- China-nexus intrusion activity increased 38%. Edge devices were targeted in 40% of cases involving vulnerability exploitation, with some newly disclosed flaws weaponized within days.
- Ransomware actors exploited monitoring gaps across identity, SaaS, and virtualization infrastructure, using unmanaged virtual machines for credential theft and remote SMB encryption to avoid executing ransomware on managed hosts.
- Supply chain cases included compromised software updates and npm packages. Malicious Nx packages used victims’ local AI command-line tools to generate commands for stealing authentication materials and cryptocurrency assets.
Article Details
- Publisher
- CrowdStrike
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global threat activity analyzed through CrowdStrike intelligence, customer telemetry, threat hunting, and incident response.
- Key Statistics
- Attacks by AI-enabled adversaries increased 89% in 2025 compared with 2024.
- Average eCrime breakout time fell from 48 minutes in 2024 to 29 minutes in 2025; the fastest observed breakout took 27 seconds.
- 82% of detections in 2025 were malware-free, compared with 79% in 2024 and 51% in 2020.
- Cloud-conscious intrusions increased 37% year-over-year in 2025, including a 266% increase among named state-nexus threat actors; valid account abuse accounted for 35% of cloud incidents.
- The number of zero-day vulnerabilities exploited before public disclosure increased 42% year-over-year in 2025.
- Recommendations
- Apply AI governance, access controls, data classification, runtime protection against prompt injection, and security assessments of AI products and dependencies.
- Strengthen phishing-resistant MFA, enforce least privilege for service and non-human accounts, and monitor anomalous SaaS and token activity.
- Consolidate telemetry and correlate activity across endpoints, identities, cloud environments, SaaS applications, and unmanaged hosts to accelerate detection and response.
- Harden developer environments, enforce code signing and dependency validation, scan repositories and packages for anomalies, and assess third-party risk.
- Prioritize patching edge devices within 72 hours of critical vulnerability disclosure, enable perimeter and virtualization logging, and segment networks to limit lateral movement.
MITRE ATT&CK
T1003.003 · NTDSSCATTERED SPIDER mounted domain controller disks on unmanaged virtual machines and extracted the ntds.dit database and SYSTEM registry hive.T1070.006 · TimestompWARP PANDA used custom malware capabilities to timestomp files during persistent intrusions.T1071.004 · DNSHOLLOW PANDA configured ShadowPad implants to communicate using DNS tunneling.T1078 · Valid AccountsAdversaries used compromised SSO, cloud, and other legitimate accounts to access victim environments and blend into authorized activity.T1098.005 · Device RegistrationSCATTERED SPIDER and BLOCKADE SPIDER used device registration in cloud identity attacks; COZY BEAR also registered devices while attempting to bypass conditional access policies.T1110.003 · Password SprayingORB28 infrastructure was used for high-volume password spraying against Entra ID accounts; its exclusive association with MURKY PANDA remained undetermined.T1114.003 · Email Forwarding RuleBLOCKADE SPIDER created Microsoft 365 mail-forwarding rules as part of activity intended to prevent legitimate users from receiving security alerts.T1190 · Exploit Public-Facing ApplicationMultiple adversaries exploited internet-facing VPN appliances, firewalls, gateways, and enterprise applications for initial access.T1195.002 · Compromise Software Supply ChainAdversaries compromised software packages and update mechanisms to distribute malicious code, including ShaiHulud through npm and malicious payloads through Notepad++ updates.T1199 · Trusted RelationshipMURKY PANDA compromised upstream IT service providers and abused trusted connections between Entra ID tenants to access downstream organizations.T1219 · Remote Access ToolsCHATTY SPIDER persuaded employees to install remote monitoring and management software or grant workstation access through Microsoft Quick Assist.T1486 · Data Encrypted for ImpactPUNK SPIDER used Akira to encrypt files through remote SMB shares; BLOCKADE SPIDER encrypted virtualization infrastructure using Embargo.T1562.001 · Disable or Modify ToolsBLOCKADE SPIDER broadened an existing EDR exclusion rule to all users, creating a staging directory where malicious binaries avoided EDR alerts.T1566 · PhishingFANCY BEAR distributed LAMEHUG through spear-phishing, while other adversaries used phishing and voice-based social engineering to obtain access.T1567.002 · Exfiltration to Cloud StorageCHATTY SPIDER pivoted to Google Drive for attempted data exfiltration after a WinSCP connection was blocked.
CVE
CVE-2023-46805exploiting VPN appliances through CVE-2024-21887 and CVE-2023-46805,CVE-2024-21887exploiting VPN appliances through CVE-2024-21887 and CVE-2023-46805,CVE-2024-24919the adversary likely exploited CVE-2024-24919 or leveraged previously compromisedCVE-2024-3400appliances. The adversary exploited CVE-2024-3400, a critical command injectionCVE-2025-0282CVE-2025-22457 and CVE-2025-0282, were previously exploited as zero-days.CVE-2025-22457CVE-2025-22457 and CVE-2025-0282, were previously exploited as zero-days.CVE-2025-25257public proof-of-concept (POC) exploits, OPERATOR PANDA exploited CVE-2025-25257, a SQL injection vulnerability.CVE-2025-31324Similarly, PHANTOM PANDA exploited CVE-2025-31324 on April 27, 2025, three days after the vendor publiclyCVE-2025-3248exploited CVE-2025-3248 clone of a legitimate MCP serverCVE-2025-32706In late April 2025, eCrime adversary VICE SPIDER highly likely exploited a zero-day LPE vulnerability (CVE-2025-32706)CVE-2025-55182VAULT PANDA and GENESIS PANDA both deployed exploits targeting React2Shell (CVE-2025-55182) on DecemberCVE-2025-59287vulnerability (CVE-2025-59287) before deploying ShadowPad.CVE-2025-61882zero-day vulnerability now tracked as CVE-2025-61882.
Threat Actors
ARMORY CASTLEExploited VPN appliances at U.S.-based legal, technology, and manufacturing organizations, then deployed custom malware in vCenter environments.BLOCKADE SPIDERConducted Embargo ransomware operations spanning edge devices, cloud identities, SaaS applications, and virtualization infrastructure. The report states that no known link exists with SCATTERED SPIDER despite similar techniques.Cozy BearUsed trusted-contact impersonation and Entra ID authorization-code and device-code phishing against U.S.-based NGOs and a legal entity.Fancy BearDeployed LAMEHUG against Ukrainian government entities and exploited webmail vulnerabilities for intelligence collection.GRACEFUL SPIDERRepeatedly exploited zero-days in internet-exposed enterprise applications, including CVE-2025-61882 in data exfiltration operations beginning as early as August 2025.HOLLOW PANDACompromised Check Point VPN appliances across multiple countries and deployed ShadowPad. CrowdStrike could not determine the exact initial compromise method.Imperial KittenUsed EvilGinx2 for credential phishing against Israeli Microsoft 365 users in November 2025, followed by account enumeration.Jade SleetCompromised Safe{Wallet} to redirect Bybit cryptocurrency transactions, stealing assets then valued at 1.46 billion USD.MURKY PANDAAbused trusted relationships between Entra ID tenants to compromise downstream organizations and used ORB28 for delegated email access.PUNK SPIDERCrowdStrike observed 198 intrusions in 2025, a 134% year-over-year increase. The adversary used remote SMB encryption with Akira and AI-generated post-exploitation scripts.Salt TyphoonCompromised network appliances, rapidly weaponized disclosed vulnerabilities, and targeted telecommunications providers.Scattered SpiderConducted cross-domain ransomware intrusions using help desk social engineering, hybrid identity abuse, unmanaged virtual machines, and ransomware deployment on VMware ESXi.Silent Ransom GroupPrimarily targeted law firms through voice phishing and remote access software; in one observed intrusion, attempted exfiltration began approximately four minutes after initial access.VICE SPIDERHighly likely exploited CVE-2025-32706 as a zero-day for local privilege escalation in late April 2025.Void DokkaebiUsed AI in fraudulent employment operations and malicious npm packages with recruitment-themed social engineering to deliver BeaverTail to developers.
Malware
AkiraExecutes Akira ransomwareBeaverTailnpm packages with social engineering techniques to deliver BeaverTail malwareBRICKSTORMdeploying the malware families BRICKSTORM, TetanusStorm, DualGauge, Junction,Doshell StealerAI to distribute BRASH SPIDER’s Doshell Stealer and COOKIE SPIDER’s SHAMOS malware by marketingEmbargocross-domain tradecraft in Embargo ransomware campaigns. The adversaryLAMEHUGUses LAMEHUG malware,OrBitunpatched edge devices, � Modifies Entra ID victim Entra ID tenant vCenter using OrBitShadowPadaccounts. Following initial access, the adversary deployed ShadowPad malware viaShaiHuluddistribute a new version of the self-propagating information stealer ShaiHulud. To observe how threat actors use theseSHAMOSAI to distribute BRASH SPIDER’s Doshell Stealer and COOKIE SPIDER’s SHAMOS malware by marketing
Vendors
CrowdStrikeCROWDSTRIKE 2026 GLOBAL THREAT REPORT 2Microsoftpersuaded an employee to grant workstation access via Microsoft Quick Assist. Within four minutes, CHATTY SPIDERPalo Alto Networkscompromising Cisco IOS XE devices, Palo Alto Networks firewalls, and other networkSalesloftIn September 2025, Salesloft disclosed an intrusion that occurred between March 2025 and June 2025
Products
Active Directory Federation Serviceshave targeted the hybrid Entra ID solutions Entra Connect Sync and Active Directory Federation Services (AD FS). TheyE-Business Suite (EBS)| | | | On-Premises | | E-Business Suite (EBS) | | |Entra Connect Sync| | IDENTITY-LEVEL | (Entra Connect Sync) | | | |Entra IDEntra ID authentication flows through targeted phishing.Langflowagainst Langflow AI to deploy that forwarded emails toMicrosoft 365 Apps for Enterprisein Microsoft 365 toNotepad++OverWatch identified a legitimate Notepad++ update process delivering maliciousPAN-OSvulnerability in Palo Alto Networks PAN-OS, days after a POC exploit forRoundcube Webmailand n-day vulnerability exploitation impacting Zimbra and Roundcube webmailSafe{Wallet}PRESSURE Safe{Wallet} BybitVMware ESXifor data discovery and exfiltration, and in many cases, deploying ransomware solely on VMware ESXi infrastructure.VMware vCenterself-service retrieves user's VMware vCenter passwordWindows Server Update ServicesPANDA targeted a U.S.-based aviation entity in late 2025, exploiting a Windows Server Update Services (WSUS) RCEZimbraand n-day vulnerability exploitation impacting Zimbra and Roundcube webmail
Tools
AD Explorerand executes AD Explorer to gather userEvilginx2targeting cloud identities when they deployed the EvilGinx2 phishing kit to targetGoSecretsDumpVM configured with DC VMDK; uses GoSecretsDump toTruffleHogThe threat actor likely obtained these credentials from compromised SaaS instances using TruffleHog,WinSCPaccess via the RMM tooling, CHATTY SPIDER typically downloaded the file transfer tool WinSCP and used it in an attemptWormGPTcybercrime, such as WormGPT, though with significantly less frequency.
Countries
AustraliaPoint VPN appliances across multiple intrusions, targeting organizations in Australia,BelarusCrowdStrike Intelligence team performed throughout 2025 and describes INCLUDING BELARUS ADVERSARYChinaChina-nexus activity increased 38% in 2025. In 67% of the vulnerabilitiesDPRKOther Democratic People's Republic of Korea (DPRK)-nexus adversaries’ activityIndiaHACKTIVIST INDIAIranIRAN TÜRKIYEIsraelBrazil, India, Indonesia, Israel, Mexico, the Philippines, Southeast Asia, and the U.S.RussiaRUSSIA GEORGIAUkraineinternational NGO branches and pro-Ukraine organizations. The adversary heavily invested inUnited Stateslegitimate credentials and trusted administrative tools. In this intrusion, the adversary targeted a U.S.-based law firm and
Industries
Aviationattacks against aviation, insurance, and retail targets. Moderately skilled threat actors such as VICE SPIDER reliedFinancial Servicesincreased by 85%, telecommunications by 30%, and financial services by 20%.GovernmentTECHNOLOGY MANUFACTURING RETAIL FINANCIAL SERVICES HEALTHCARE TELECOMMUNICATIONS GOVERNMENT INDUSTRIALS AND ACADEMIC MEDIAHealthcareTECHNOLOGY MANUFACTURING RETAIL FINANCIAL SERVICES HEALTHCARE TELECOMMUNICATIONS GOVERNMENT INDUSTRIALS AND ACADEMIC MEDIALegaloperations targeted U.S.-based legal, technology, and manufacturing entities bylogisticsChina-nexus targeted intrusion activity; in particular, attacks targeting logisticsManufacturingConsulting, manufacturing, retail, and other data-rich industries also experienced elevated activity. Figures 1 and 2RetailConsulting, manufacturing, retail, and other data-rich industries also experienced elevated activity. Figures 1 and 2TechnologyAdversaries of all motivations exploited AI technology throughout 2025 toTelecommunicationsincreased by 85%, telecommunications by 30%, and financial services by 20%.