Collection of cybersecurity reports, surveys, research papers, market studies, and industry intelligence.
726 articles
Acronis telemetry shows only about 4.8% of customer tenants use a fitted specialty role, while 33.9% have no local administrator. The company urges customers and MSPs to adopt role-based access control for least privilege.
The Verizon DBIR reports that vulnerability exploitation accounted for 31% of breaches and third-party involvement rose to 48%. Wiz’s contribution found only 26% of tracked KEVs fully remediated, with median remediation time increasing to 43 days.
A week of Sophos Windows endpoint telemetry found AI coding agents triggering detections for credential access, execution and persistence. Sophos recommends narrowly scoping execution alerts while continuing to protect credential stores.
Cyble’s H1 2026 analysis describes dark-web markets supporting ransomware, initial-access sales, identity attacks, geopolitical operations and AI-enabled tools; it reports 702 ransomware attacks and 54 major breaches and leaks worldwide in March.
ESET's H1 2026 report highlights malicious AI skills, AI-assisted Android malware, rising ClickFix and QR-code phishing, and continued ransomware activity involving tools that disable security software.
Kaspersky’s 2025 compromise assessments found that 30.8% of discovered incidents had activity older than three months. The report highlights missed alerts, web shells in backups and gaps in monitoring and incident response.
ReliaQuest says ClickFix dominated initial access and defense evasion in its March–May analysis, expanding to macOS and developer lures. The technique uses deceptive prompts to trick users into running malicious commands.
A review of 2025–2026 reporting finds AI is helping threat actors scale familiar tactics, from reconnaissance and phishing to malware development and agentic operations, while pressuring defenders to respond faster.
Google Threat Intelligence Group says Russia’s influence ecosystem is shifting back toward global targets while continuing to focus on Ukraine, using interconnected actors, persistent campaigns, cyber-enabled operations, and increasingly generative AI.
A threat-intelligence report reviews Iranian, Russian, and Chinese activity targeting water infrastructure from 2024–2026, describing incidents, access methods, strategic aims, recurring security weaknesses, and indicators for defenders.
Recorded Future assesses Mexico’s 2025–2030 cybersecurity plan against ransomware, financial malware, data theft, state-sponsored activity, hacktivism, and organized crime, and urges stronger coordination, incident readiness, and public cyber awareness.
Hunt.io analyzed three months of telemetry across 10 Eastern European countries, identifying 3,923 potentially malicious infrastructure endpoints. After provider feedback, it clarified that software presence—especially Keitaro—does not prove C2 or malicious use.
CYFIRMA analyzed a fake Indian Income Tax Department portal at harivo[.]vip that delivers a staged Windows malware payload. The report details obfuscation, persistence, RAT-like capabilities and encrypted C2; actor attribution remains unconfirmed.
An 18-day SIP honeypot study recorded 1.87 million credential attempts across 29,433 extensions and 89,465 call attempts, many targeting UK revenue-share ranges. The honeypot rejected all authentication attempts.
INTERPOL’s 2025/2026 assessment reports widespread phishing, rising ransomware and AI-enabled scams across Asia and the South Pacific, alongside growing cybercrime losses and expanded regional law-enforcement cooperation.
Flare analyzed 470 underground forum posts describing services that search infostealer-derived credential collections for target-specific results. Buyer feedback cited invalid or duplicated credentials; defenders are advised to monitor exposures and secure affected logi
CYFIRMA’s 2026 report examines MCP tool poisoning, rug pulls, cross-server abuse and STDIO command injection, citing gateway exposures and agent-driven exfiltration cases. It recommends server allowlisting, least privilege, behavioral monitoring and input validation.
Wiz says its AI pentester found over 17,000 issues across about 1,000 environments in one month, including more than 5,500 high- or critical-severity findings. The article highlights access-control flaws, exposed secrets, and data exposures.
Recorded Future assesses state digital surveillance risk in 193 countries, finding high or very high risk in 31. The report details government surveillance capabilities, oversight concerns, risks to travelers and organizations, and recommended mitigations.
Acronis’s May 2026 update reports malware and URL detection trends and details the Instructure breach, in which attackers stole user data and exploited Canvas XSS vulnerabilities, prompting access revocation, patches and other response measures.
Acronis examines INC ransomware’s growth to more than 800 claimed victims since 2023, its intrusion methods and Windows and Linux/ESXi payloads, and offers IOCs and mitigation recommendations.
The report describes Russian-linked operations using compromised routers for DNS hijacking and collection, alongside phishing and account abuse targeting messaging platforms and Microsoft 365. It assesses high-risk targets and recommends router, messaging, and identity-
Zscaler’s 2026 report says phishing activity fell 20% in both 2024 and 2025, while campaigns became more targeted. FBI-reported phishing losses rose from $70 million in 2024 to $215 million in 2025.
Recorded Future's Insikt Group identified more than 36 inauthentic maritime websites across three linked clusters, likely used by Iranian- and Russian-linked sanctions-evasion networks to impersonate authorities and generate fraudulent ship and seafarer documents.
