Dataminr’s 2026 Threat Report Highlights Identity Attacks and Larger Cyber Losses
Report discovered via Awesome Annual Security Reports.
Summary
Dataminr’s review of 2025 reports a 225% rise in average monthly threat actor alerts, growing identity-centric attacks and larger outlier losses. It also highlights incomplete patches and urges risk-based vulnerability prioritization.
Key points
- The report uses qualitative and quantitative analysis drawn primarily from Dataminr and ThreatConnect data covering calendar year 2025.
- Dataminr reports that average monthly threat actor alerts rose 225%, from 1,490 in 2024 to 4,840 in 2025; these figures measure alerts, not confirmed incidents.
- Digital-risk monitoring generated more than 2 million domain impersonation alerts and 443,000 phishing alerts during 2025.
- The report says valid credentials featured in 30% of cyber intrusions and links growing identity-centric activity to infostealers and AI-enhanced social engineering.
- It identifies Qilin as 2025’s most active ransomware group and highlights Cl0p’s encryption-less extortion and Scattered Lapsus$ Hunters’ social engineering.
- Financial analysis describes a shift toward fewer typical losses but greater exposure to very large incidents, driven by identity compromise, third-party concentration and operational disruption.
- The report cites patch bypasses affecting SharePoint, WSUS, SAP NetWeaver and Grafana, and recommends prioritizing remediation using exploitation likelihood, targeting frequency and business impact alongside CVSS.
Article Details
- Publisher
- Dataminr
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global cyber threats, vulnerabilities, external digital risks, threat actor activity, and cyber incident financial impacts, primarily using Dataminr and ThreatConnect data.
- Key Statistics
- For 2025, Dataminr reported more than 6.3 million external threat alerts, 4.8 million vulnerability alerts, and 3.1 million digital risk alerts; these are alert counts, not confirmed incident counts.
- Average monthly threat actor alerts increased 225%, from 1,490 in 2024 to 4,840 in 2025.
- Dataminr reported more than 18,000 ransomware activity alerts in 2025.
- The report states that valid credentials were involved in approximately 30% of cyber intrusions; the underlying sample size is not provided.
- The report states that 63% of organizations opted not to pay ransoms in 2025, compared with 59% in the prior year; the underlying sample size is not provided.
- Recommendations
- Combine vulnerability data, real-time threat actor activity, and external digital risk intelligence rather than assessing them separately.
- Prioritize remediation using exploitation likelihood, targeting frequency, organization-specific exposure, and business impact rather than CVSS alone.
- When leaked organizational credentials are identified, institute password resets and additional monitoring for anomalous user behavior.
- Monitor third-party breaches early enough to assess and, where necessary, remove connections to compromised platforms.
- Beyond patching SharePoint, enable Antimalware Scan Interface (AMSI) and ensure EDR platforms are configured to detect the described attacks.
MITRE ATT&CK
T1055.012 · Process HollowingRemcos is described as using process hollowing by suspending a legitimate process, injecting code, and resuming it.T1056.001 · KeyloggingThe malware descriptions identify keystroke logging by Formbook, Agent Tesla, Remcos, and other remote access malware.T1071.001 · Web ProtocolsThe report describes HTTP POST exfiltration by Lumma Stealer and WebSocket communications by Rhadamanthys and Brickstorm.T1078 · Valid AccountsThe report describes intrusions using valid credentials rather than exploiting systems to gain access.T1113 · Screen CaptureFormbook, Agent Tesla, and ASyncRAT are described as capturing screenshots.T1115 · Clipboard DataFormbook and Agent Tesla are described as collecting clipboard data.T1190 · Exploit Public-Facing ApplicationAttackers exploited enterprise application vulnerabilities, including SharePoint flaws, for initial compromise.T1496 · Resource HijackingXMRig is described as frequently bundled into malware for cryptojacking.T1498 · Network Denial of ServiceNoName05716 is described as conducting crowd-sourced DDoS attacks against critical infrastructure.T1543.003 · Windows ServiceASyncRAT is described as achieving persistence by creating new services on Windows.T1566 · PhishingPhishing is described as a major intrusion vector and a delivery mechanism for infostealer malware.T1573 · Encrypted ChannelRhadamanthys, ASyncRAT, and Brickstorm are described as using encrypted communications to conceal malware traffic.T1574.001 · DLLFormbook is described as employing DLL search order hijacking.
CVE
CVE-2025-49706with a Microsoft SharePoint vulnerability, where attackers bypassed the initial July patches (CVE-2025-49706/49704) within days by using simple path traversal techniques, forcing the issuance of new CVEsCVE-2025-53770within days by using simple path traversal techniques, forcing the issuance of new CVEs (CVE-2025-53770/53771) for the same underlying flaws.CVE-2025-55182- **CVE-2025-55182**: CVSS 10.0. An unauthorized RCE vulnerability allowing attackers with no authentication to run arbitrary code. Likelihood: Very High. Financial Risk: $$$$$
Threat Actors
Black ForcePresented as an alternate name for Hezi Rash in the report's list of active threat actors.Cl0pDescribed as using encryption-less extortion and large-scale data theft while avoiding the noise of system encryption; attributed to Russia by the report.Dark EnginePresented as an alternate name alongside Infrastructure Destruction Squad in the report's group summaries.EverestDescribed as both an intruder and an access broker; the report assesses its connection to Russia as likely.Hezi RashPresented with the alternate name Black Force and described as a relatively new, aggressive Kurdish nationalist group among the most active actors by alert volume.hubzExplicit alias of jrintel, the financially motivated information broker profiled in the report.hubzXjrintelExplicit alias of jrintel, the financially motivated information broker profiled in the report.IDSExplicit abbreviation for Infrastructure Destruction Squad, the group reportedly associated with VoltRuptor.INC RansomDescribed as a ransomware group with a reputation for providing working decryptors after payment; the report assesses its connection to Russia as likely.Infrastructure Destruction SquadAlso identified as IDS and paired with Dark Engine in the report; described as Russia-aligned and reportedly responsible for developing VoltRuptor.JR IntelExplicit alias of jrintel, the independent broker described as trafficking stolen sensitive information.jrintelFinancially motivated information broker reportedly emerging in August 2025 and trafficking military, intelligence, government, and personal data; explicitly also known as JR Intel, hubz, and hubzXjrintel.Keymous+Described as using ideological branding to promote commercial DDoS services.NoName05716Identified as the most active pro-Russian hacktivist collective, using crowd-sourced DDoS attacks and gamification.QilinIdentified by the report as the most active ransomware group of 2025, offering affiliates high payouts and a stable platform.ROMCOMPresented with the alternate tracking name Storm-0978 and described as combining state-aligned espionage with financial theft.Scattered Lapsus$ HuntersAlso called SLH in the report; described as an alliance of three sub-groups of The Com using AI-enhanced social engineering and help-desk manipulation.SLHAbbreviation explicitly used for Scattered Lapsus$ Hunters, which the report associates with identity-centric attacks and double extortion.Storm-0978Presented as an alternate tracking name for RomCom, an actor associated with espionage and financial theft.The ComCybercrime collective whose three sub-groups are described as forming the Scattered Lapsus$ Hunters alliance.
Malware
Agent Tesla| Agent Tesla | Keylogger and RAT that captures clipboard data, screenshots, and audio/video. | Accepts nearly 40 commands for file management, command execution, process manipulation, and loading additional malware.AsyncRAT| ASyncRAT | Stealthy, polymorphic RAT targeting Windows. Capabilities include screen control, keystroke logging, file exfiltration, webcam capture, and remote desktop. | Achieves persistence by modifying the registryBRICKSTORM| Brickstorm | Sophisticated, cross-platform backdoor malware primarily used for long-term cyber espionage. Attributed to People’s Republic of China (PRC) state-sponsored threat actors. | Uses advanced techniques toFormBook| Formbook | Also tracked as xloader (MaaS) infostealer, stealing browser credentials, keystrokes, clipboard content, screenshots, and web form data, and can download other files. | Employs sophisticated evasionLumma Stealer| Lumma Stealer | Sophisticated, MaaS infostealer distributed through Russian forums. | Uses anti-debugging and custom XOR obfuscation for evasion. Stolen data is exfiltrated via HTTP POST to a C2 server, delivered asMirai| Mirai | Exploits weak default credentials and vulnerabilities in devices like routers and cameras to form massive botnets. | Can generate traffic bursts over 100 Gbps, targeting various sectors. Its proliferation andnjRAT| NjRAT | RAT used for unauthorized system control. Facilitates malicious activities like keylogging, credential theft, webcam access, ransomware deployment, and system manipulation. | Collects data, disables securityRemcos| Remcos | RAT that grants attackers full control over infected systems for data exfiltration and keystroke logging. | Evades detection using obfuscation, API hash values, Vectored Exception Handling, and processRhadamanthys| Rhadamanthys | MaaS infostealer. Linked to Hidden Bee, its authors treat it as a long-term business, selling it for a monthly fee via Tor and Telegram. | The multi-stage infection uses loaders and employs newVoltRuptor| VoltRuptor | ICS & SCADA-specific malware strain reportedly developed by Russia-aligned hacking group Infrastructure Destruction Squad (IDS). | Designed for cross-platform operations. It features multi-protocolXLoader| Formbook | Also tracked as xloader (MaaS) infostealer, stealing browser credentials, keystrokes, clipboard content, screenshots, and web form data, and can download other files. | Employs sophisticated evasion
Vendors
CitrixCitrix NetScaler ADC logs and network traffic can be exploited by dangerous but theFortinetFortinet FortiOS and interfaces are disabled, Internet facing machines Impacts would includeMicrosoftThe most prominent example was observed with a Microsoft SharePoint vulnerability, where attackers bypassed the initial July patches (CVE-2025-49706/49704) within days by using simple path traversal techniques, forcingSAPThis pattern was repeated in Windows Server Update Services (WSUS) and SAP NetWeaver, where initial patches for critical vulnerabilities failed to account for all deserialization vectors, necessitating emergency
Products
Backup MigrationAffects Backup Migration Patch the CVE, disable the Very High $Erlang/OTPof the Erlang/OTP (OpenFortiOSFortinet FortiOS and interfaces are disabled, Internet facing machines Impacts would includeFortiProxyFortiProxy, the core admin access is restricted can be exploited by DFIR ($250k-2M), $2-15MGeoServer| vulnerability in GeoServer, | library module and/or | | |GrafanaSimilarly, Grafana attempted to fix a vulnerability using client-side restrictions that were easily circumvented, rather than validating server-side input.Microsoft SharePointThe most prominent example was observed with a Microsoft SharePoint vulnerability, where attackers bypassed the initial July patches (CVE-2025-49706/49704) within days by using simple path traversal techniques, forcingNetScaler ADCCitrix NetScaler ADC logs and network traffic can be exploited by dangerous but theSAP NetWeaverThis pattern was repeated in Windows Server Update Services (WSUS) and SAP NetWeaver, where initial patches for critical vulnerabilities failed to account for all deserialization vectors, necessitating emergencyWindows Server Update ServicesThis pattern was repeated in Windows Server Update Services (WSUS) and SAP NetWeaver, where initial patches for critical vulnerabilities failed to account for all deserialization vectors, necessitating emergency
Tools
Burp Suite| Burp Suite | The leading tool for web application security testing. | Used to intercept and modify web traffic to find or exploit web vulnerabilities. |Cobalt Strike| Sliver | An open-source adversary simulation (C2) framework. | A powerful, free alternative to expensive tools like Cobalt Strike. |Gophish| GoPhish | An open-source phishing framework used by companies to train employees. | It makes setting up and tracking a mass phishing campaign very easy. |Hak5 Cloud| Hak5 Cloud | Managing Hak5 hardware (like the Rubber Ducky or WiFi Pineapple). | Allows remote control of physical hardware used to compromise local networks. |Havoc| Havoc | A modern, open-source C2 framework focused on evasion. | Designed to bypass modern antivirus (AV) and EDR, making it perfect for stealth. |Interactsh| Interactsh | Testing for “Out-of-Band” (OOB) vulnerabilities like SSRF or Blind SQLi. | Used to confirm if an exploit worked by pinging a server they control. |Metasploit Framework| Metasploit | The industry standard for penetration testing and exploit development. | Provides a massive library of ready-to-use exploits to break into systems. |Mythic| Mythic | A modular, collaborative C2 framework for Red Team operations. | Its modular nature makes it very hard for defenders to create a single "fingerprint." |Sliver| Sliver | An open-source adversary simulation (C2) framework. | A powerful, free alternative to expensive tools like Cobalt Strike. |XMRig| XMRig | A high-performance, open-source Monero (cryptocurrency) miner. | The most abused on this list. It is frequently bundled into malware for "cryptojacking." |
Countries
People’s Republic of Chinacross-platform backdoor malware primarily used for long-term cyber espionage. Attributed to People’s Republic of China (PRC) state-sponsored threat actors. | Uses advanced techniques to hide its command-and-controlRussia| VoltRuptor | ICS & SCADA-specific malware strain reportedly developed by Russia-aligned hacking group Infrastructure Destruction Squad (IDS). | Designed for cross-platform operations. It features multi-protocolUnited Kingdom- **Scattered Lapsus$ Hunters (US & UK)**: Proved that technical “un-hackability” is irrelevant if the human at the help desk can be manipulated.United States- **Scattered Lapsus$ Hunters (US & UK)**: Proved that technical “un-hackability” is irrelevant if the human at the help desk can be manipulated.
Industries
Critical infrastructure- **NoName05716**: Remained the most active pro-Russian hacktivist collective, primarily utilizing crowd-sourced DDoS attacks against critical infrastructure.Financial ServicesCVSS: 9.4 | At-risk industries: Financial Services | Overall Risk: HighGovernmentkeep tabs on everything happening that presents cyber risk. Regardless of size, every organization and government agency has a complex infrastructure of assets to manage. For larger ecosystems, that number could reachManufacturingCVSS: 9.8 | At-risk industries: Manufacturing | Overall Risk: ModerateTelecommunicationsCVSS: 10 | At-risk industries: Telecommunications | Overall Risk: High