Security Report · raw.githubusercontent.com

Arctic Wolf’s 2026 Threat Report Finds Remote Access Abuse Behind 65% of Non-BEC Cases

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Arctic Wolf’s 2026 report analyzes incident-response cases from Nov. 2024 to Nov. 2025, finding ransomware, BEC and data incidents made up 92% of cases, while remote access abuse drove 65% of non-BEC cases.

Key points

The report draws on 12 months of Arctic Wolf incident-response engagements, from Nov. 1, 2024, to Nov. 1, 2025, supplemented by platform telemetry and leak-site data.
Ransomware, business email compromise (BEC) and data incidents accounted for 44%, 26% and 22% of cases, respectively; data incidents rose from 2% in the prior report to 22%.
Abuse of external remote access products and services—including RDP, VPN and RMM tools—accounted for 65% of non-BEC cases; known-vulnerability exploits accounted for 11%.
Email phishing was attributed to 85% of BEC cases. The report also says ransomware was contained before detonation in 5% of cases.
More than three-quarters of ransomware-response cases ended without a ransom payment; among cases where victims paid, Arctic Wolf reported an average 67% reduction from the initial demand.
The report describes campaigns targeting IT staff and developers, including GPUGate, Oyster/Broomstick and a supply-chain campaign that compromised more than 180 npm packages.
Recommendations include prioritizing patches for exploited vulnerabilities, rotating exposed credentials, securing remote access, strengthening authentication, and improving logging and network segmentation.

Article Details

Publisher: Arctic Wolf
Report Period: 2024-11-01 to 2025-11-01
Scope: Global digital forensics and incident response engagements, supplemented by Arctic Wolf Aurora Platform telemetry and leak-site research.
Key Statistics: Ransomware accounted for 44%, business email compromise (BEC) for 26%, and data incidents for 22% of Arctic Wolf IR cases; together, these categories represented 92%.
Remote access product and service abuse accounted for 65% of non-BEC IR cases; external exploitation of known vulnerabilities accounted for 11% of non-BEC cases.
Email phishing was attributed to 85% of BEC IR cases.
Data incidents rose from 2% of IR cases in the prior report to 22% in this reporting period.
The median initial ransom demand fell 20% to $414,000; in 23% of ransomware cases where victims paid, Arctic Wolf reported an average 67% reduction from the initial demand.
Recommendations: Minimize internet exposure, prioritize patching known exploited vulnerabilities—especially on edge devices—and rotate credentials after suspected vulnerability exposure.
Isolate management interfaces from public access, restrict administrative access, and use IP-based filtering.
Require strong, phishing-resistant multi-factor authentication and regularly review VPN accounts.
Centralize logs and use behavioral analytics to detect lateral movement and persistence.
Segment critical systems, and maintain and test incident-response plans and backups.