Picus Red Report 2026 Finds Shift Toward Stealth and Persistent Access
Report discovered via Awesome Annual Security Reports.
Summary
Picus analyzed over 1.1 million malicious files and 15.5 million adversarial actions from 2025. Its Red Report 2026 finds growing emphasis on evasion and persistence, with process injection ranked first and encryption-for-impact activity declining.
Key points
- Picus Labs mapped more than 15.5 million adversarial actions across over 1.1 million malicious files analyzed during 2025 to MITRE ATT&CK.
- The report characterizes 80% of its top ten techniques as dedicated to evasion and persistence, suggesting an emphasis on long-lived access rather than immediate disruption.
- Process Injection (T1055) ranked first, followed by Command and Scripting Interpreter (T1059) and Credentials from Password Stores (T1555).
- Virtualization/Sandbox Evasion (T1497) ranked fourth; examples include malware checking system artifacts and user interaction before activating.
- Picus observed a 38% decline in Data Encrypted for Impact (T1486), which ranked tenth; this measures the technique rather than the overall number of ransomware incidents.
- The report highlights trusted-cloud abuse, including SesameOp using OpenAI's Assistants API with a stolen API key to retrieve encrypted instructions and upload execution results.
- Recommendations emphasize behavioral monitoring, identity and network telemetry, and continuous validation of defenses against evasive techniques.
Article Details
- Publisher
- Picus Security
- Report Period
- 2025
- Scope
- Global malicious-file behavior mapped to MITRE ATT&CK for The Red Report 2026.
- Sample Size
- Over 1.1 million malicious files and more than 15.5 million adversarial actions.
- Key Statistics
- The report categorizes 8 of its top 10 techniques as defense evasion, persistence, or stealthy command and control.
- Data Encrypted for Impact prevalence fell from 21.00% in the 2025 report to 12.94% in the 2026 report, a reported 38% relative decrease.
- Credentials from Password Stores appeared in 23.49% of samples in the 2026 report.
- Masquerading had a reported prevalence of 16.59% and ranked sixth.
- Process Injection ranked first for the third consecutive year.
- Recommendations
- Continuously validate security controls against evasive adversary behaviors rather than assuming protection.
- Combine identity, network, and workload telemetry to address gaps in endpoint visibility.
- Monitor cloud API activity, enforce least-privilege access and MFA, and maintain comprehensive cloud logging.
- Restrict permissions on W32Time DLLs and registry settings through Group Policy.
- Monitor unexpected changes to port-monitor registry keys and scrutinize DLLs loaded by the Print Spooler service.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 571f2143cf04cca39f92c67a12ea088bf0aee1161f490e1f8a935019939d56cb | Hash presented in the Snapekit rootkit analysis describing malicious kernel-module deployment and concealment. |
| SHA256 | 827c2bfb7f028924c5ec60dab9fda84c5d25ba6b1340e4d6ca0d515636b73974 | Malware sample associated with the December 2025 analysis of malicious SSP installation, credential harvesting, and reboot persistence. |
| SHA256 | 845d1e3825790109ec90c6c2ee6c2e95b971780448d2e18bd855c421de8de4fe | December 2025 malware sample identified as using Active Setup for persistence. |
| URL | hxxp[:]//45[.]200[.]148[.]157:8878/payload.ps1 | Attacker-hosted follow-on PowerShell payload fetched by the persistent HellCat ransomware execution chain. |
| URL | hxxp[:]//45[.]200[.]148[.]157:8878/payload2.ps1 | Attacker-hosted second PowerShell payload fetched for in-memory execution in the HellCat ransomware chain. |
MITRE ATT&CK
T1036 · MasqueradingAttackers disguise malicious files and processes as legitimate resources.T1055 · Process InjectionMalware injects code into legitimate processes to conceal execution; ranked first in the report.T1055.012 · Process HollowingASyncRAT delivery used suspended legitimate processes whose memory was replaced with malicious code.T1055.013 · Process DoppelgängingAPT37 and GhostPulse reportedly used NTFS transactions for process doppelgänging.T1059 · Command and Scripting InterpreterAdversaries use command and scripting interpreters for execution, collection, lateral movement, and defense evasion.T1071 · Application Layer ProtocolThe report describes application-layer communications used for command and control.T1219.003 · Remote Access HardwareDPRK operatives reportedly use IP-KVM devices to remotely control laptop farms below operating-system monitoring.T1486 · Data Encrypted for ImpactUNC3944 executed ransomware through the ESXi shell to encrypt datastore-level files.T1490 · Inhibit System RecoveryRansomHub operators deleted VSS snapshots and disabled the VSS service to obstruct recovery.T1497 · Virtualization/Sandbox EvasionMalware checks system artifacts, user interactions, and execution timing to avoid sandbox analysis.T1547 · Boot or Logon Autostart ExecutionMalware modifies boot and user-logon execution mechanisms to survive restarts.T1547.001 · Registry Run Keys / Startup FolderHellCat used a Run key to fetch and execute PowerShell payloads at user logon; an AdaptixC2 beacon used a Startup-folder shortcut.T1555 · Credentials from Password StoresAttackers extract saved credentials from browsers, password managers, and cloud secrets stores.T1562 · Impair DefensesAttackers disable security products, interfere with logging, and modify defensive configurations.T1562.001 · Disable or Modify ToolsValleyRAT added a drive-wide Defender exclusion through PowerShell.
Threat Actors
APT37Reportedly used process doppelgänging in September 2025 to execute a backdoor following phishing access.Gold MelodyInitial access broker described using privilege-escalation tooling and legitimate-looking local account names for persistent access.MuddyWaterA September 2025 intrusion analysis described SMB-based remote execution and WMI for lateral movement.STORM-0501Observed querying cloud secrets stores through APIs to harvest credentials.UNC3886China-nexus espionage group reported deploying custom backdoors on Junos OS routers and clearing shell history.UNC3944Abused privileged accounts and ESXi shell access for offline credential theft, exfiltration, and ransomware deployment.UNC6384Reportedly delivered STATICPLUGIN to diplomatic targets using installer impersonation and a malicious MSI disguised as a BMP.XDSpyUsed malicious LNK files, parsing discrepancies, and DLL sideloading to deploy a persistent data-exfiltration implant.
Malware
AsyncRAT15, PureRAT 15, ASyncRAT malware 16, GhostPulse 19, LummaStealer 20,Atomic StealerInterlock ransomware 27, Atomic Stealer 29, Koske malware 30, RansomHubGHOSTPULSE15, PureRAT 15, ASyncRAT malware 16, GhostPulse 19, LummaStealer 20,HellCat31, HellCat ransomware 32, ValleyRAT 33, Chihuahua Stealer 34, Crypto24HijackLoaderIDAT Loader 20, CherryLoader 21LummaC2behavior using geometry. For example, LummaC2 now calculates theRansomHubInterlock ransomware 27, Atomic Stealer 29, Koske malware 30, RansomHubSesameOpSesameOp backdoor, which routed all traffic through OpenAI'sSnapekitA particularly sophisticated example of this type of attack is the Snapekit rootkitValleyRAT31, HellCat ransomware 32, ValleyRAT 33, Chihuahua Stealer 34, Crypto24
Vendors
Products
Assistants APIAssistants API, masking C2 communications as legitimate AIAWS Secrets Managercloud secrets stores (e.g., AWS Secrets Manager) via API to harvestESXiFor instance, in mid-2025, UNC3944 was observed abusing the ESXi hypervisorJunos OSTINYSHELL variants) on Juniper Networks Junos OS routers 47. This campaignMicrosoft Defender Antimalware Platform# queries the service state of Microsoft Defender ATP sensor.PiKVMPiKVM, to control massive laptop farms.VMware vCenter Serveraccounts, the group used inherited vCenter admin rights to enable SSH on ESXivSphereCLI as a central mechanism in its vSphere-focused intrusion chain 51. After socially
Tools
AdaptixC2CABINETRAT 23, AdaptixC2 77, EtherRAT 83,Empireinclude Empire 35 for post-exploitation tactics, PowerSploit 36] for securityGodPotatoattackers deployed a binary named updf, which abuses the GodPotato exploit,Nishangtesting, Nishang 37] with varied attack functionalities, PoshC2 38] for serverPosh-SecModadministration and post-exploitation, and Posh-SecMod 39] offering security andPoshC2testing, Nishang 37] with varied attack functionalities, PoshC2 38] for serverPowerSploitinclude Empire 35 for post-exploitation tactics, PowerSploit 36] for securityROPChainand ROPChain) that search the process's memory mappings for specific instructionsROpgadgetown code. To find gadgets, an attacker can use tools (such as ROPgadget, Ropper,Ropperown code. To find gadgets, an attacker can use tools (such as ROPgadget, Ropper,