Sopra Steria’s 2026 Security Report Highlights Identity Threats and Nordic Infrastructure Risks
Report discovered via Awesome Annual Security Reports.
Summary
Sopra Steria’s 2026 report says phishing accounted for 44.4% of security incidents in its Scandinavian customer base during 2025. It highlights identity theft, supply-chain compromise, AI risks, and resilience priorities for Nordic organisations.
Key points
- Sopra Steria Scandinavia reports that 44.4% of security incidents in its customer base during 2025 were phishing-related.
- The report describes attackers stealing credentials and session tokens through phishing, infostealers, and adversary-in-the-middle techniques to access accounts and bypass MFA.
- ClickFix activity is rising in the Nordics: deceptive prompts persuade users to paste commands that trigger PowerShell or mshta.exe to load malicious payloads.
- Supply-chain examples include Shai-Hulud targeting npm packages and stolen OAuth tokens used through the Salesloft Drift integration to access Salesforce customer environments.
- Sopra Steria says it has observed malicious Model Context Protocol packages designed to harvest credentials, exfiltrate sensitive data, and compromise local devices.
- The report identifies IT–OT dependencies as a major infrastructure risk, warning that disruption to supporting IT or communications can affect physical operations without directly attacking control systems.
- Recommended priorities include phishing-resistant MFA, least privilege, rapid patching of internet-facing systems, segmentation, isolated immutable backups, and tested incident-response plans.
Article Details
- Publisher
- Sopra Steria
- Report Period
- 2025 observations and 2026 outlook
- Scope
- Nordic cyber threats, customer SOC observations, mobile security, IT/OT resilience, governance, regulation, and penetration-testing findings.
- Key Statistics
- Sopra Steria Scandinavia reported that 44.4% of security incidents in its customer base during 2025 were phishing-related; the incident count was not disclosed.
- Sopra Steria Scandinavia's customers collectively received more than 635 million inbox emails during 2025, excluding junk and quarantined messages.
- Citing ENISA, the report states that public administration accounted for 38% of reported EU incidents, with hacktivist-led DDoS accounting for 96.2% of incidents in that sector.
- Citing ICS Strive/Waterfall, the report describes 76 publicly reported incidents with physical impact in 2024; nearly 90% indirectly affected industrial operations through supporting IT systems.
- The report cites assessments estimating that MDM alone mitigates up to 40% of mobile attack techniques, increasing to approximately 90% when combined with MTD.
- Recommendations
- Enforce phishing-resistant MFA, least privilege, privileged access management, and continuous monitoring of credential additions and privilege changes.
- Maintain an asset inventory and risk-prioritized patching process, prioritizing internet-facing systems and isolating critical systems when immediate patching is not possible.
- Segment IT, OT, production, development, and backup environments; combine IT/OT monitoring and maintain immutable, isolated backups.
- Develop and regularly exercise incident-response and continuity plans with clear responsibilities, escalation paths, and stakeholder communication procedures.
- Integrate cybersecurity into executive governance, document risk decisions, assess critical third parties, and establish AI-specific access controls, supply-chain vetting, and mandatory review of generated code.
MITRE ATT&CK
T1047 · Windows Management InstrumentationAttackers used Windows Management Instrumentation for persistence and lateral movement.T1053.005 · Scheduled TaskAttackers used scheduled tasks to maintain access while blending into legitimate administrative activity.T1059.001 · PowerShellClickFix lures induced users to execute commands that triggered PowerShell to load payloads; attackers also used PowerShell after compromise.T1071.004 · DNSMalware encoded commands and stolen data within DNS queries to conceal communications.T1098 · Account ManipulationCloud persistence included adding rogue credentials, roles, and API keys and manipulating identity permissions.T1110.003 · Password SprayingAdversaries used password spraying to obtain credentials.T1190 · Exploit Public-Facing ApplicationThreat actors exploited network-facing vulnerabilities in exposed, unpatched systems for initial access.T1195.002 · Compromise Software Supply ChainHijacked npm maintainer accounts were used to publish trojanized packages that stole developer and CI/CD secrets.T1218.005 · MshtaClickFix commands used mshta.exe to load malicious payloads.T1539 · Steal Web Session CookieAiTM campaigns intercepted session tokens, while mobile phishing kits stole session cookies.T1550.002 · Pass the HashPass-the-Hash remained a prevalent lateral-movement technique.T1550.003 · Pass the TicketPass-the-Ticket remained a prevalent lateral-movement technique.T1550.004 · Web Session CookieAttackers used stolen session tokens to bypass MFA and access cloud accounts.T1555.003 · Credentials from Web BrowsersInfostealers and credential harvesters collected browser-stored passwords early after compromise.T1566 · PhishingPhishing was a leading initial-access vector observed in the customer base, including credential-harvesting lures and malicious downloads.
CVE
People
Threat Actors
NoName057(16)Pro-Russian group that Sopra Steria reported targeting Norway around its parliamentary election; the attacks were publicly claimed through Telegram.PromptLockDescribed by the report as a ransomware group discovered using generative AI tools such as Claude Code to develop malicious payloads on infected systems.Salt TyphoonCited in the discussion of prolonged persistence and espionage operations in which attackers remain undetected.
Vendors
Products
Azure ADpremises AD integrates with Azure AD or These findings confirm that identityClaude Codeopportunities but also introduces new as Claude Code to develop maliciousESXiESXi being actively weaponised. AttackersMicrosoft Active DirectoryActive Directory (AD) continues to playMicrosoft SharePointCritical RCE flaw in on‑prem SharePointMicrosoft Windowsof AI capabilities into Windows via NPUs generation models such as OpenAI SoraNetScaler ADC and GatewaySevere flaw in NetScaler ADC/Gateway here, they gain theSalesforceadvanced techniques (such as device combined during 2025 (excluding junk and Deepfake Risk supply chain attack targeted SalesforceSalesloft Driftcode phishing, OAuth consent phishing, quarantined mails). With an average of 5.5 The candidate’s video presence customers through the Salesloft Drift
Tools
Countries
Chinaprimarily from Russia, China, Iran, andIranprimarily from Russia, China, Iran, andIsraelblend overt and covert tactics. They campaigns primarily target Israel andNorth KoreaRussia North KoreaNorwayNorway’s and the broader Nordic its history of destructive cyberattacksRussiaIts strategic position near Russia and opportunities, but also expands the attackSwedenthe Nordics is evolving rapidly, becoming breach victims, with Sweden ranking ninth oll a o raUkraineregion’s support for Ukraine, coupled against critical infrastructure during
Industries
Education and researchEducation and Research Water and WastewaterEnergyenergy supply chain, make sectors such Korea with expertise and infrastructure,financeWestern undersea infrastructure, other critical domains such as finance, making these organisations more from ransomware, credential theft, andHealthcarebusiness operations. These risks necessitate coupled to a single ecosystem. financial records, healthcare information,ITAs industrial systems connect to broader networks, simple weaknesses With 2026 ahead, it is important to be prepared for what is coming.Manufacturingrather than lack of adversary interest. volume and complexity, targeting telecom Manufacturing ITPublic administrationwhich is vital for both energy supply, healthcare, and public administration. vulnerable to both cybercriminal, and APT actors seeking to steal data orTelecommunicationsEnergy and TelecomTransportation and Logistics| Finance | Public Administration | Transport and Logistics |Water and wastewaterEducation and Research Water and Wastewater