Truesec 2026 Report Finds Fewer Successful Ransomware Encryptions in the Nordics
Report discovered via Awesome Annual Security Reports.
Summary
Truesec reports fewer successful ransomware encryptions in the Nordics in 2025 despite rising intrusion attempts. Its annual report highlights credential abuse, software supply chain threats and the prospect of faster AI-assisted attacks.
Key points
- Truesec's 2025 observations show increasing intrusion attempts but fewer ransomware incidents reaching encryption and extortion, with more attackers evicted before completing their objectives.
- More than a third of ransomware incidents Truesec handled began with valid credentials used against exposed VPN gateways or terminal servers; almost 14% of the valid credentials used were obtained through password spraying.
- The report says most observed cybercriminal and espionage actors now use commercial remote monitoring and management tools for persistence rather than RATs or Cobalt Strike.
- S1ingularity, Shai-Hulud and Glassworm illustrate software supply chain threats targeting developer credentials, package registries and extensions, potentially exposing build pipelines and production infrastructure.
- One anonymized case involved an organization reporting five ransomware encryptions in a year after repeated backup restoration without resolving the underlying access weakness; stolen credentials and configuration data can enable subsequent compromises.
- Truesec predicts AI will primarily increase attack speed and volume in 2026 and warns that compromised identities could let intruders use company LLMs to locate sensitive information.
- Recommendations include phishing-resistant MFA, network segmentation, isolated privileged administration, dependency inventories and behavioral detection backed by rehearsed response procedures.
Article Details
- Publisher
- Truesec
- Report Period
- 2025
- Scope
- Cyber threats, incident response observations, software supply chain attacks, and defensive practices, with emphasis on the Nordics and Northern Europe.
- Key Statistics
- More than one-third of ransomware incidents handled by Truesec in 2025 began with valid usernames and passwords used against exposed VPN gateways or terminal servers.
- Almost 14 percent of valid credentials used in ransomware attacks handled by Truesec CSIRT in 2025 were obtained through password spraying; how most remaining credentials were compromised was largely unknown.
- The reported Shai-Hulud incident compromised more than 500 npm packages.
- One ransomware victim told Truesec that it had been encrypted five times in 2025; previous responses had restored backups without addressing the initial access weakness.
- In one incident Truesec responded to in 2025, the attacker tried more than 10,000 username and password combinations before finding valid credentials.
- Recommendations
- Enforce network segmentation, least privilege, and administrative tiering; restrict critical infrastructure management ports to dedicated privileged access workstations.
- Deploy MFA, favoring hardware-backed or PKI/FIDO2 methods, and monitor failed logins and subsequent successful authentications.
- Investigate and remediate initial access weaknesses after ransomware incidents rather than relying solely on backup restoration.
- Maintain software dependency inventories with exact versions, download timestamps, and execution records; separate development and production environments and vet new packages before adoption.
- Prepare and rehearse response procedures for password resets, blocking compromised accounts, and revoking cloud access; prioritize behavioral detection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | productivity-tools[.]ai | Domain used by the malicious PDF Editor installation-status callback infrastructure. |
| HOSTNAME | vault[.]appsuites[.]ai | Host serving the executable that becomes the malware during the malicious PDF Editor installation. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolAn attacker moved laterally between servers using RDP in the multinational enterprise case study.T1046 · Network Service DiscoveryThe multinational enterprise attacker scanned the network to identify systems and exposed remote management ports.T1078 · Valid AccountsValid credentials enabled ransomware intrusions; one case involved local firewall accounts with default passwords and no MFA.T1110.003 · Password SprayingTruesec attributed almost 14 percent of valid credentials used in its 2025 ransomware cases to password spraying.T1110.004 · Credential StuffingThe report describes attackers reusing credentials leaked from another service to authenticate to corporate VPNs.T1133 · External Remote ServicesAttackers gained initial access through exposed VPN gateways and terminal servers.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious package and extension updates compromised software dependencies distributed through npm and extension registries.T1485 · Data DestructionThe insider sabotage case involved deliberate deletion of critical resources, systems, and data.T1486 · Data Encrypted for ImpactRansomware encrypted victim systems, including virtual machines in the multinational enterprise case study.T1490 · Inhibit System RecoveryA disgruntled employee deleted backups, snapshots, and other system copies to limit recovery.T1518.001 · Security Software DiscoveryTamperedchef queried the system for installed security products during initialization.T1539 · Steal Web Session CookieThe report describes attackers stealing browser session cookies for subsequent access to cloud services.T1547.001 · Registry Run Keys / Startup FolderThe malicious PDF Editor installer added a registry key that executed the program at startup for persistence.T1555.003 · Credentials from Web BrowsersTamperedchef queried browser databases using DPAPI and terminated browsers, likely to access locked browser data.T1562.001 · Disable or Modify ToolsThe insider disabled key security features in the cloud infrastructure before destructive activity.
Threat Actors
Black CatNamed among ransomware groups whose activities were disrupted by law enforcement infrastructure seizures.DragonForceIdentified as a newer RaaS brand replacing older groups in the ransomware ecosystem.LazarusDescribed as part of North Korea’s military intelligence service and as collaborating with Russian ransomware groups to finance North Korea’s weapons programs.LockBitNamed among ransomware groups whose activities were disrupted by law enforcement infrastructure seizures.QilinIdentified as a newer RaaS brand replacing older groups in the ransomware ecosystem.RansomHubNamed among ransomware groups whose activities were disrupted by law enforcement infrastructure seizures.Silent RansomIdentified as the actor behind a 2025 cyber-extortion incident involving email subscription flooding and callback phishing.The ComLoosely organized online collective whose members conduct cyber extortion and other cybercrime; some also offer swatting or violence services.
Malware
Vendors
Products
Azureto conduct ongoing risk assessments Azure independently on a licensingGoogle Adsproducts. Then it terminates referrers from Google AdsMicrosoft Active DirectoryMicrosoft Active Directory domain quick succession, the threat actorMicrosoft Hyper-Vscans and Domain Name a Microsoft Hyper-V cluster thatPDF Editor- [Deep Dive: The Malicious PDF Editor](#deep-dive-the-malicious-pdf-editor)VSCodeextensions for Visual Studio Code, When such accounts are
Tools
Countries
Chinaand China to align with these countries’ respective positions on global conflicts, or face consequences.Denmarkincorporate what we understand about warfare. Denmark and Sweden will holdIranis a risk that international efforts against cyberattacks begin to fracture, adversaries like Russia, Iran, North Korea, and China appear to collaborate closer than ever, while the U.S.North Korearisk that international efforts against cyberattacks begin to fracture, adversaries like Russia, Iran, North Korea, and China appear to collaborate closer than ever, while the U.S.Norwayabuse. Recently, Norway found hiddenRussiaand there is a risk that international efforts against cyberattacks begin to fracture, adversaries like Russia, Iran, North Korea, and China appear to collaborate closer than ever, while the U.S.SwedenIn Sweden, Truesec has seen what we assess to be nation-state intelligence services using local criminals to target senior executives to get them to give up their organizations’ support to Ukraine.UkraineThe armed invasion of Ukraine is met with financial sanctions from the West, which in turn triggers retaliation in the form of sabotage and disinformation.United Kingdomand the UK, but also from France, Canada, and Brazil, have emerged who conduct cyber extortion, sometimes in collaboration with Russian RaaS groups.United Statesthe erosion of the international rules-based order. Since World War II, the Western alliance, led by the U.S., has advocated a rules-based order as a legal framework for managing international conflicts. Many of
Industries
Critical infrastructureThe geopolitical situation will determine the risk of cyber sabotage against Europe and its critical infrastructure.Defensevulnerabilities to create fear, confusion, are becoming key hubs for defenseSoftware developmentsoftware development. New production considerably faster, but