cyber.hendryadrian.com
Security Report · raw.githubusercontent.com

Red Canary’s 2026 Threat Detection Report Highlights Surge in Identity Threat Detections

· Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Red Canary’s 2026 report analyzes 110,000 confirmed threats detected in 2025. Identity threats accounted for 53% of detection volume, while AI misuse, paste-and-run lures, and remote management tool abuse featured prominently.

Key points

  • The study draws on 2025 telemetry from 1,700 organizations, identifying 110,000 confirmed threats, including 34,000 higher-severity threats.
  • Identity threat detections rose 850% from 2024 and represented 53% of detection volume. Red Canary attributes the increase partly to expanded identity coverage, improved risky-login detection, and automation—not solely increased adversary activity.
  • Cloud Accounts (T1078.004) remained the most prevalent ATT&CK technique in the dataset, underscoring the importance of valid accounts in cloud and identity compromise.
  • The report describes AI primarily as an accelerator of existing attack techniques, while identifying prompt injection, excessive agent permissions, and insecure MCP integrations as risks to corporate AI infrastructure.
  • Paste-and-run lures delivered stealers on Windows and macOS. LummaC2 and Rhadamanthys ranked fifth and tenth among detected threats; macOS campaigns used shell scripts and AppleScript to evade Gatekeeper.
  • Ransomware affiliates continued exploiting older vulnerabilities and using email bombing, help-desk impersonation, and legitimate remote management tools. The report also notes a shift toward data theft and extortion without encryption.
  • Red Canary recommends least privilege, scoped credentials, vetted AI integrations, browser extension controls, and monitoring of remote management tools. Its early-stage detection focus limits visibility into later intrusion outcomes.

Article Details

Publisher
Red Canary
Report Period
2025
Scope
Confirmed threats across customer endpoints, networks, cloud infrastructure, identities, and SaaS applications; visibility is weighted toward early-stage intrusion activity.
Sample Size
More than 110,000 threats across 4.5 million protected systems and identities; telemetry from 1,700 organizations.
Key Statistics
  • Identity threat detections increased 850 percent from 2024 to 2025; the report attributes the increase partly to expanded product adoption, detection coverage, and automation.
  • Identity threats represented 53 percent of overall detection volume in 2025, compared with 20 percent in 2024.
  • Of 110,000 confirmed threats detected in 2025, 34,000 were higher-severity threats that might have posed significant customer risk without detection.
  • JustAskJacky affected 7.4 percent of customer organizations in 2025 and ranked second among threats by customer prevalence.
  • Red Canary processed 283 Rhadamanthys IP indicators across at least 97 network providers in 2025; 34 of those providers' ASNs spent some time on the Spamhaus DROP list.
Recommendations
  • Enforce least privilege, require administrative approval for OAuth applications, and use short-lived, scoped credentials with rapid rotation after exposure.
  • Prioritize patching internet-facing vulnerabilities and deploy detection and response sensors across endpoints to reduce monitoring gaps.
  • Inventory RMM software, block unsanctioned tools with application controls, and monitor permitted tools for suspicious behavior.
  • Maintain vetted MCP server registries, audit server capabilities, isolate deployments, and separate credentials for public and sensitive internal resources.
  • Use managed browsers and extension allowlists; educate users about paste-and-run lures and revoke sessions and reset exposed credentials after stealer infections.

Indicators of compromise

TypeIndicatorContext
DOMAINkongtuke[.]comEarly C2 domain used by the KongTuke malicious traffic distribution system.
DOMAINlalclenfjhkinbn[.]topMintsLoader delivery domain in an example paste-and-run PowerShell command downloading the next stage.
DOMAINputty-cn[.]comMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputty-go[.]comMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputty-pc[.]comMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputty-ssh[.]comMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputty[.]runMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputtya[.]comMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputtylime[.]shopMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputtyonline[.]orgMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
DOMAINputtyy[.]comMalicious fake-PuTTY distribution domain associated with CleanUpLoader.
HOSTNAMEapi[.]cjby76nlcynrc4jvrb[.]comExample JustAskJacky C2 hostname receiving system identifiers and supporting remote command delivery.
HOSTNAMEputty-app[.]naymin[.]comMalicious fake-PuTTY distribution host associated with CleanUpLoader.
HOSTNAMEputty-download[.]fmwyd[.]comMalicious fake-PuTTY download host associated with CleanUpLoader.
HOSTNAMEputty-download[.]gblec[.]comMalicious fake-PuTTY download host associated with CleanUpLoader.
HOSTNAMEputty-download[.]macpav[.]comMalicious fake-PuTTY download host associated with CleanUpLoader.
HOSTNAMEputty-download[.]yapof[.]comMalicious fake-PuTTY download host associated with CleanUpLoader.

MITRE ATT&CK

T1027.003 · SteganographyTampered Chef concealed executable JavaScript in invisible Unicode characters mixed with legitimate content.T1053.005 · Scheduled TaskJustAskJacky and CleanUpLoader created scheduled tasks for persistence.T1059.001 · PowerShellMintsLoader used PowerShell to download and execute additional stages; exploited WSUS endpoints also executed encoded PowerShell commands.T1059.007 · JavaScriptJustAskJacky executed JavaScript through Node.js, including remotely supplied encoded code.T1078.004 · Cloud AccountsCloud Accounts was the most prevalent technique in the dataset; adversaries used valid cloud identities to access resources.T1110.003 · Password SprayingAdversaries tested common passwords across many accounts while staying below account lockout thresholds.T1110.004 · Credential StuffingAdversaries tested username and password combinations stolen from previous breaches against other services.T1190 · Exploit Public-Facing ApplicationRansomware affiliates exploited internet-facing SonicWall VPN and Veeam vulnerabilities for initial access.T1195.002 · Compromise Software Supply ChainShai-Hulud propagated through malicious npm package versions, while compromised browser extensions delivered malicious updates.T1218.011 · Rundll32CleanUpLoader scheduled rundll32.exe to execute its malicious DLL through the DllRegisterServer entry point.T1219 · Remote Access ToolsAdversaries abused RMM software for remote access, persistence, lateral movement, and command and control.T1490 · Inhibit System RecoveryCloud extortion operations destroyed backup vaults and snapshots to prevent recovery.T1528 · Steal Application Access TokenAdversaries stole application access tokens through AitM phishing, malicious OAuth consent grants, and stealer malware.T1530 · Data from Cloud StorageAdversaries collected credentials and sensitive organizational data from cloud storage for access brokering and extortion.T1621 · Multi-Factor Authentication Request GenerationMFA fatigue attacks repeatedly triggered push notifications to induce users to approve access.

CVE

CVE-2023-22527According to a February 2025 report, the LockBit group exploited a 10.0 CVSS vulnerability in Atlassian Confluence from two years prior (CVE-2023-22527) to spread ransomware.CVE-2023-27532adversaries exploited known Veeam vulnerabilities for initial access and privilege escalation: CVE-2023-27532, which targets the Veeam Backup & Replication component to obtain initial access, and CVE-2024-40711,CVE-2024-40711CVE-2023-27532, which targets the Veeam Backup & Replication component to obtain initial access, and CVE-2024-40711, a critical vulnerability that allows for remote code execution and privilege escalation.CVE-2024-40766Since at least August 2025, adversaries deploying Akira ransomware reportedly obtained initial access via misconfigured SonicWall VPNs or by exploiting SonicWall VPNs vulnerable to CVE-2024-40766.

Threat Actors

AkiraRansomware group whose affiliates reportedly exploited SonicWall VPN vulnerabilities or misconfigurations; Red Canary observed associated exfiltration or encryption activity.BianLianNamed among threat groups adopting data-theft extortion without encryption.Cl0pNamed among threat groups adopting data-theft extortion without encryption.GTG-1002Chinese state-sponsored group that Anthropic assessed used Claude Code and MCP tools in a largely autonomous espionage operation.HuntersNamed among threat groups adopting data-theft extortion without encryption.InterlockRansomware group linked in the report to KongTuke delivery activity.LAPSUS$Named among threat groups adopting data-theft extortion without encryption.LockBitA cited February 2025 report described exploitation of CVE-2023-22527 in Atlassian Confluence to spread ransomware.STORM-0501Conducted cloud extortion using hybrid identity compromise, cloud-native data exfiltration, and destruction of data and recovery options.UNC6395Stole OAuth tokens during the Salesloft Drift compromise and used them to access Salesforce data and some connected Google Workspace instances.

Malware

Atomic Stealerinto a sophisticated credential harvesting ecosystem, with malware-as-a-service (MaaS) families like Atomic Stealer, Odyssey Stealer, and Rhadamanthys systematically exfiltrating passwords, session tokens, accessJustAskJackyJustAskJacky, the second most prevalent threat Red Canary detected in 2025, is a functioning AI chatbot that answers users’ questions but executes encoded commands in the background.LummaC2Driven in part by malware-as-a-service stealers like LummaC2MintsLoaderand run (aka ClickFix) to trick users into executing • MintsLoaderOdyssey Stealercredential harvesting ecosystem, with malware-as-a-service (MaaS) families like Atomic Stealer, Odyssey Stealer, and Rhadamanthys systematically exfiltrating passwords, session tokens, access keys, and otherOysterLoaderany suspicious or malicious activity that represents of featured threat CleanUpLoader, as wellRhadamanthysecosystem, with malware-as-a-service (MaaS) families like Atomic Stealer, Odyssey Stealer, and Rhadamanthys systematically exfiltrating passwords, session tokens, access keys, and other credentials that canShai-HuludExample compromise: Shai-Hulud (2025)SocGholishthat, like SocGholish, relied on maliciousTamperedChefanother threat in our top 10: Tampered Chef. openmymanual.exe

Vendors

AnthropicIn September 2025, Anthropic detected and disrupted what they assessed as the first largely AI-orchestrated cyber espionage campaign, where a Chinese state-sponsored group used Claude Code to execute approximately 80-90AppleDetection Reports may remember that AppleMicrosoftNext, the adversary—posing as an IT admin offering to help with the email problem—contacted the user via phone or a link to join a Microsoft Teams call.OpenAISolutions like OpenAI’s Atlas browser and ChatGPT’s “agent mode” exemplify how autonomous AI agents can introduce new, unmanaged vectors for prompt injection and data exfiltration.SalesloftExample compromise: Salesloft Drift (2025)SAPIn 2025, Red Canary tracked vulnerabilities in software including SAP NetWeaver, Microsoft Windows Server Update Services, and SharePoint.SonicWallSince at least August 2025, adversaries deploying Akira ransomware reportedly obtained initial access via misconfigured SonicWall VPNs or by exploiting SonicWall VPNs vulnerable to CVE-2024-40766.VeeamIn observed Play, Qilin, and Akira intrusions, the affiliate adversaries exploited known Veeam vulnerabilities for initial access and privilege escalation: CVE-2023-27532, which targets the Veeam Backup & Replication

Products

Amazon Q VS Code extensionsessions with AI CLI tools to facilitate these prompt injection attacks. One example is the Amazon Q VSCode extension compromise, where an adversary attempted to wipe every machine that had it installed though theAtlassian ConfluenceAccording to a February 2025 report, the LockBit group exploited a 10.0 CVSS vulnerability in Atlassian Confluence from two years prior (CVE-2023-22527) to spread ransomware.Claude Codethe first largely AI-orchestrated cyber espionage campaign, where a Chinese state-sponsored group used Claude Code to execute approximately 80-90 percent of tactical operations autonomously, with human operatorsGoogle Workspacecompromised connected Google WorkspaceMicrosoft SharePointIn 2025, Red Canary tracked vulnerabilities in software including SAP NetWeaver, Microsoft Windows Server Update Services, and SharePoint.Microsoft WSUSA critical RCE vulnerability in Microsoft’s Windows Server Update Service (WSUS) was patched in an out-of-band update in October 2025. Researchers reported shortly after the update that adversaries were activelySalesforceto Salesforce (a central database for sales) soSalesloft DriftExample compromise: Salesloft Drift (2025)SAP NetWeaverIn 2025, Red Canary tracked vulnerabilities in software including SAP NetWeaver, Microsoft Windows Server Update Services, and SharePoint.Veeam Backup & Replicationvulnerabilities for initial access and privilege escalation: CVE-2023-27532, which targets the Veeam Backup & Replication component to obtain initial access, and CVE-2024-40711, a critical vulnerability that allows

Tools

Advanced Port Scanneraffiliates using SoftPerfect Network Scanner to obtain information about network devices, Advanced Port Scanner to identify open ports, and SharpShares to enumerate accessible network shares.Atomic Red Teameasy-to-use Atomic Red Team tests that youAzureHoundHybrid identity exploitation: like AzureHound to document available andBloodHoundAdversaries also utilized BloodHound to obtain information about the Active Directory environment.Mac Monitorfree Mac Monitor tool. other stealer families, providing safe softwarePsExecused what works, and what works is to use tools inherent to the system. To this end, adversaries used `PsExec` and `net.exe` to move to adjacent hosts or escalate privileges.SharpSharesScanner to obtain information about network devices, Advanced Port Scanner to identify open ports, and SharpShares to enumerate accessible network shares.SoftPerfect Network ScannerThis past year, we also observed ransomware affiliates using SoftPerfect Network Scanner to obtain information about network devices, Advanced Port Scanner to identify open ports, and SharpShares to enumerate accessibleSurveyorlike Surveyor to get a better understanding of inventory management tool to identify anyTruffleHogreporting on adversaries abusing TruffleHog,

Countries

China| **China** | Reconnaissance, scripting and development, research on ways to attain further access to target environments. |Iran| **Iran** | Heaviest users among government-backed groups. Phishing campaign development, reconnaissance, vulnerability research, translation, and localization. |North Korea| **North Korea** | Attack lifecycle research such as potential hosting infrastructure, reconnaissance on targets, payload development. A notable example was to draft cover letters and resumes to support clandestine ITRussia| **Russia** | Notably limited engagement with Gemini, some basic coding tasks and localization work. |

Related Articles