Collection of cybersecurity reports, surveys, research papers, market studies, and industry intelligence.
729 articles
AhnLab’s March 2026 report describes ransomware activity across critical sectors and groups, including DLS-based exposure and blackmail. It cautions that a methodology change in December 2025 limits comparisons with earlier months.
A 2025 ransomware year-in-review estimates attacks rose 40–50% year over year, with manufacturing and other critical sectors heavily targeted. It describes rising costs, double extortion, AI-assisted phishing, and expanding ransomware-as-a-service operations.
An audit of 428 API hubs found, researchers report, malicious response injection, compromised AWS canary credentials, rapid use of leaked API keys and theft from an Ethereum honeypot; they recommend signed responses and stricter hub controls.
A Huntress survey of 1,050 IT and security professionals found teams feel least prepared for identity attacks, while 64.1% say at least a quarter of their alerts are noise. The article recommends improving alert quality, identity visibility, and incident ownership.
Acronis telemetry puts immutable backup usage at about 49PB across roughly 170,000 tenants—1.4% of its 3,600PB backup footprint. The article recommends staged deployment, cloud or dual destinations, storage planning, monitoring, and restore tests.
A LayerX report says AI browser extensions are widely used, often have elevated permissions, and can evade traditional enterprise monitoring. It recommends inventorying extensions and continuously reviewing their behavior and permissions.
ASEC's March 2026 analysis found Windows infostealers mainly in EXE files, with DLL side-loading also observed. macOS activity included 472 Bash scripts, 117 C2 domains, ClickFix clipboard execution, and rapidly mutating samples.
A DomainTools executive summary describes North Korea’s cyber program as a compartmentalized portfolio: Kimsuky for espionage, Lazarus Group for financial operations and Andariel for disruption, with shared tooling and replaceable toolchains complicating attribution.
Qualys says its analysis of more than 1 billion CISA KEV remediation records across 10,000 organizations found persistent patching delays despite increased ticket closures, and argues for measuring cumulative exposure and automating risk operations.
Wiz’s retrospective finds that familiar weaknesses drove about 80% of documented 2025 cloud intrusions. AI expanded where those risks could appear and helped accelerate existing attacker workflows.
Cyble’s weekly report tracked 1,960 vulnerabilities, including 248 with public PoC exploits. It also covered CISA KEV additions, critical enterprise and ICS flaws, unpatched advisories, and remediation recommendations.
Trend Micro’s Q1 2026 review covers alleged nation-state activity, public-sector breaches, ransomware trends, and actively exploited vulnerabilities, with recommended steps for government and education security teams.
The FBI’s IC3 received over 1 million cybercrime complaints reporting $20.877 billion in losses in 2025, up 26% from 2024. Cryptocurrency investment fraud accounted for more than $7.2 billion in reported losses.
The FBI says U.S. victims reported nearly $21 billion in cyber-enabled crime losses in 2025, up 26% year over year. IC3 complaints exceeded 1 million; AI-related scams accounted for $893 million in reported losses.
Bitdefender’s DNS investigation links LummaStealer activity to CastleLoader and reports 211 IoCs. Telemetry showed 103,038 potential victim IPs communicating with 10 IoC IPs; the researchers advise further investigation of flagged entities.
The FBI’s 2025 IC3 report recorded $17.6 billion in cyber-enabled fraud losses, 85% of total reported losses. It also highlighted ransomware activity, AI-related complaints and cryptocurrency-linked theft.
Cyble's weekly roundup tracks 1,452 vulnerabilities, including 222 with public PoCs and eight added to CISA's KEV catalog, and reviews critical flaws across enterprise, AI, EV charging and ICS environments with remediation guidance.
GreyNoise analyzed 4 billion malicious sessions over three months and found that 78% of residential-originating sessions evaded reputation feeds. It recommends behavior-based detection, including sequential-probing detection and persistent device fingerprints.
Semgrep’s 2025 analysis of remediation across 50,000+ repositories found large fix-rate gaps by OWASP category and linked stronger remediation to actionable PR scans, selective merge blocks, reachability analysis, and 90-day escalation.
Blackpoint Cyber’s 2026 Annual Threat Report, based on thousands of investigations, finds that intrusions often use legitimate access, remote-management tools, and social engineering. It highlights SSL VPN abuse, ClickFix-style campaigns, and session-token reuse after-M
An analysis of 11 threats featured in Picus’s Red Report 2026 examined 147 network indicators and related DNS and WHOIS data, finding typosquatting clusters, early risk signals and additional potentially malicious infrastructure.
JPCERT/CC’s TSUBAME sensors observed suspicious packets from networks with exposed NVR, router and SDN-controller interfaces, and compared scanning volumes and destination ports across Japan and overseas from July to September 2025.
A four-month Infoblox–Confiant study finds threat actors use Keitaro’s tracker, cloaker and traffic-distribution features to scale scams, phishing and malware delivery; it documents wallet-drainer spam, malware hosting and domain-hijacking activity.
Cyble’s 2025 energy and utilities threat landscape report records 187 ransomware attacks and highlights legacy OT, IT/OT convergence, access brokers and slow patching. It recommends segmentation, faster patching, market monitoring and offline backups.
