Recorded Future’s 2026 Security Report Highlights Persistent Access and Fragmenting Cybercrime
Report discovered via Awesome Annual Security Reports.
Summary
Recorded Future’s 2026 State of Security report describes growing state-backed pre-positioning and decentralized cybercrime in 2025. Insikt Group identified 289 new ransomware variants, while observed AI use mainly improved existing techniques.
Key points
- Recorded Future assesses that state-sponsored actors increasingly accumulated persistent access to identities, cloud environments, and edge infrastructure, preserving options for espionage and disruption.
- Insikt Group linked RedMike, also publicly reported as Salt Typhoon, to targeting more than 1,000 Cisco IOS XE devices across over 100 countries; the report describes selective targeting rather than indiscriminate scanning.
- Russian activity against the US and Canada increased compared with 2024, while credential harvesting and low-visibility access supported readiness for potential disruption.
- Insikt Group identified 289 new ransomware variants in 2025, up 33%; most originated from leaked source code and builders, even as ransomware payments declined.
- Law-enforcement pressure pushed cybercriminals toward smaller collaborations, Telegram channels, private leak infrastructure, and modular tools rather than eliminating their operations.
- The report finds that malicious AI offerings primarily improve the efficiency and accessibility of existing techniques; observed AI-powered malware remained largely experimental.
- Hacktivist claims and influence operations amplified one another during regional conflicts, making independent validation important when assessing alleged breaches and operational impacts.
Article Details
- Publisher
- Recorded Future
- Report Period
- 2025
- Scope
- Global state-sponsored cyber operations, hacktivism and influence operations, cybercrime, commercial spyware, and offensive AI use.
- Key Statistics
- Insikt Group identified 289 new ransomware variants in 2025, a 33% increase from the previous year; most originated from leaked source code and builders.
- The RedMike campaign targeted more than 1,000 Cisco IOS XE devices across more than 100 countries, representing approximately 8% of exposed Cisco devices.
- Recorded Future data showed approximately 70% year-over-year growth in Russian threat actors' use of application layer and web protocols, and roughly 27% growth in command and scripting interpreter abuse.
- Recorded Future recorded eighteen cryptocurrency theft incidents associated with North Korean activity in 2025.
- The report states that synthetic identity document fraud rose by 300% in Q1 2025 and deepfake-enabled fraud increased more than tenfold since the start of 2024.
- Recommendations
- Prioritize patching or other mitigation of known exploited vulnerabilities, particularly in internet-facing network devices and VPN appliances.
- Educate employees to recognize social engineering and maintain a well-managed incident response plan.
- Validate identity consistency across hiring, onboarding, and access provisioning, and monitor post-hire access for anomalies.
- Exercise continuity and incident response plans for connectivity loss and multi-region disruption, including third-party provider dependencies.
- Define clear boundaries for AI agents, limit tool permissions, log data provenance, and maintain human oversight of external-facing actions.
MITRE ATT&CK
T1059 · Command and Scripting InterpreterRussian threat actors used command and scripting interpreters for post-compromise automation and persistence.T1071.001 · Web ProtocolsRussian threat actors increasingly relied on web-native command-and-control channels.T1078 · Valid AccountsNorth Korean operatives used stolen credentials to maintain access within foreign companies.T1090 · ProxyDevilsTongue employed intermediary servers and region-specific routing to obscure operator locations.T1190 · Exploit Public-Facing ApplicationChinese operators exploited unpatched Cisco IOS XE devices and other public-facing perimeter systems to establish access.T1486 · Data Encrypted for ImpactRansomware operators deployed ransomware against enterprise environments for extortion.T1491.002 · External DefacementHacktivists defaced public websites with nationalist propaganda during regional conflicts.T1555 · Credentials from Password StoresNorth Korean operatives harvested credentials from password stores.T1562.001 · Disable or Modify ToolsA shared antivirus killer tool used across at least eight ransomware groups terminated security processes.T1566 · PhishingThe report describes phishing by Russian actors and ransomware operators using Skitnet in phishing campaigns.
People
Threat Actors
APT36Pakistan-linked group also identified as Transparent Tribe, conducting espionage against Indian government and defense personnel.BlueDeltaGRU-linked cluster conducting large-scale credential harvesting against governments, defense institutions, energy researchers, and IT providers.Cl0pConducted mass targeting through a zero-day vulnerability in Oracle E-Business Suite.Predatory SparrowConducted disruptive operations against Iran's financial sector during June 2025; suspected Israeli government direction remains unproven.PurpleBravoNorth Korean cluster attributed activity using fake job offers and trojanized development tools to deploy malware.Salt TyphoonTracked by Insikt Group exploiting Cisco IOS XE devices at telecommunications providers; the report identifies Salt Typhoon as its public reporting name.SandwormGRU-linked cluster targeting operational technology at energy, water, and heating providers, with expanded supply-chain and logistics targeting.Scattered Lapsus$ HuntersClaimed high-profile extortion campaigns; also named SLSH, Shinysp1d3r, and Sp1d3rHunters. Its claimed merger with other groups is unverified.ShinyHuntersInsikt Group assesses it likely leads Scattered LAPSUS$ Hunters.Shinysp1d3rAlternative styling of Scattered LAPSUS$ Hunters, a collective claiming high-profile extortion campaigns.SidewinderIndia-linked group conducting targeted espionage against government, defense, and financial institutions in South Asia.Sp1d3rHuntersAlternative styling of Scattered LAPSUS$ Hunters, a collective claiming high-profile extortion campaigns.Transparent TribeAlternative name supplied for APT36, which conducted espionage against Indian government and defense personnel.
Malware
Chaosthe “hacking spree” narrative to their advantage to maximize chaos. Educating employees toDevilsTongueDevilsTongue malware, maintained an active operational footprint despite being added to theDharmaexisting ransomware families, including LockBit, Chaos, Makop, and Dharma, among others.Graphiteforensic cases of its Graphite spyware being used in the wild in April 2025. Paragon’sLockBitexisting ransomware families, including LockBit, Chaos, Makop, and Dharma, among others.Makopexisting ransomware families, including LockBit, Chaos, Makop, and Dharma, among others.Pegasusexploit attempts. Amnesty International documented continued misuse of Pegasus spywarePredatoractivity linked to its Predator spyware initially declined, suggesting short-term disruption.PromptLockAI into their attack chains. The discovery of PromptLock in August marks the first knownSkitnetdifficult. Multiple ransomware groups have also used the stealthy malware Skitnet in
Vendors
Candirudeployment associated with that country. Similarly, Israel-based Candiru, the developer of theCiscofrom Fortinet, Ivanti, Cisco, Citrix, and Palo Alto, have become primary targets for exploitation,Citrixfrom Fortinet, Ivanti, Cisco, Citrix, and Palo Alto, have become primary targets for exploitation,Fortinetfrom Fortinet, Ivanti, Cisco, Citrix, and Palo Alto, have become primary targets for exploitation,IntellexaFollowing high-profile disclosures and US sanctions against the Intellexa consortium,Ivantifrom Fortinet, Ivanti, Cisco, Citrix, and Palo Alto, have become primary targets for exploitation,Microsoftdisruption. Email and collaboration platforms, including Roundcube, Zimbra, and MicrosoftPalo Alto Networksfrom Fortinet, Ivanti, Cisco, Citrix, and Palo Alto, have become primary targets for exploitation,Paragon SolutionsParagon Solutions emerged as a notable competitor, with researchers confirming the first
Products
Atlassian Confluence Server and Data Centerexploits of Atlassian Confluence Server and Data Center, as well as the recurring abuse of theCisco IOS XEIn early 2025, Insikt Group identified a campaign exploiting unpatched Cisco IOS XEJetBrains TeamCityCitrix, and Cisco) and enterprise middleware (including JetBrains TeamCity, ConnectWise, andMicrosoft ExchangeProxyShell exploit chain in Microsoft Exchange Server. These demonstrate the importanceMicrosoft SharePointVulnerability Trends report. Notably, the SharePoint zero-day (which combines bothOpenfireOpenfire) expanded, signaling a broader strategy aimed at initial access, lateral movement, andRoundcube Webmaildisruption. Email and collaboration platforms, including Roundcube, Zimbra, and MicrosoftSalesloft DriftSalesforce, Jaguar Land Rover (JLR), and Salesloft Drift, were claimed by a group calling itselfZimbradisruption. Email and collaboration platforms, including Roundcube, Zimbra, and Microsoft
Tools
GhostGPTcyber operations, introducing three new varieties: Nytheon AI, Xanthorox AI, and GhostGPT .Nytheon AIcyber operations, introducing three new varieties: Nytheon AI, Xanthorox AI, and GhostGPT .Xanthorox AIcyber operations, introducing three new varieties: Nytheon AI, Xanthorox AI, and GhostGPT .
Countries
Chinais setting the scene for future fragmentation as the US and China race for AI dominance inIndiaconflicts involving Israel–Iran, India–Pakistan, Thailand–Cambodia, and Russia–Ukraine. TheseIranmoved well beyond the battlefield. Regional escalation involving Israel and IranIsraelmoved well beyond the battlefield. Regional escalation involving Israel and IranNorth Koreaby Insikt Group — China, Russia, Iran, and North Korea — focused on the covert accumulationPakistanconflicts involving Israel–Iran, India–Pakistan, Thailand–Cambodia, and Russia–Ukraine. TheseRussiaconflicts involving Israel–Iran, India–Pakistan, Thailand–Cambodia, and Russia–Ukraine. TheseTaiwantelecommunications organizations in Japan, Taiwan, and the US, signaling growing interest inUkraineKinetic conflict in Ukraine continuedUnited StatesThis State of Security is our assessment of the year behind us and the threats ahead,
Industries
DefenseIran is now seeking to address exposed vulnerabilities by acquiring new air defenseEnergyon Ukrainian and NATO-aligned critical infrastructure, particularly in the energy, logistics, andfinanceinfrastructure, as well as sectors rich in valuable data, including finance, law, and retail. TheGovernmentIndian government and defense personnel, likely as preparatory activity to collect sensitiveHealthcarewith high business continuity demands, such as manufacturing, healthcare, and criticallawpower struggles threaten institutions (such as international law), risk is movingManufacturingIn 2025, targeting patterns increasingly mirrored national policy priorities. ManufacturingRetailinfrastructure, as well as sectors rich in valuable data, including finance, law, and retail. Thesemiconductorand semiconductor companies were targeted more frequently, aligning with China’s drive forTelecommunicationsRedMike highlighted disciplined pre-positioning in telecommunications infrastructure: