REPORT   2026  2025  2024  2023  2022  2021  2020  2019  2018  2017

DATE

NAME

INFO

CATEGORY

SUBCATE

16.8.26

 The Jewelbug Dossier China-based hackers-for-hire group staging espionage attacks alongside a cryptocurrency fraud business. REPORT REPORT

15.8.26

 Follow-Up Analysis of the 29 December 2025 Energy Sector Incident On 29 December 2025, coordinated attacks targeted the energy sector in Poland, including 30 renewable energy facilities and a large combined heat and power (CHP) plant. These attacks were described in detail in the report published on 30 January 2026*. At the same time, another incident occurred at a smaller CHP plant supplying heat to 50,000 residents. REPORT REPORT

10.8.26

 Pass-the-Passkey Family of Attacks Coming from the field of enterprise security, we have spent much of our careers studying privilege escalation and lateral movement through attacks against Windows Integrated Authentication. But as more companies adopt cloud services, we decided to shift our attention to passkeys, which are slowly but steadily becoming the norm. REPORT REPORT

6.8.26

 Cost of a Data Breach Report 2026
The AI tipping point		 Welcome to the 21st annual Cost of a Data Breach Report. Frontier AI models have radically shifted the cybersecurity threat landscape. REPORT REPORT

5.8.26

 Security Incident INC-2026-07-28-01 The UK AI Security Institute (AISI) exists to equip governments with a scientific understanding of the risks posed by advanced AI. To achieve that goal, AISI routinely evaluates the capabilities of frontier AI systems in domains such as cybersecurity. REPORT REPORT

4.8.26

 Zero Day Provisioning Chaining TP-Link ZTP Vulnerabilities to Infiltrate Networks REPORT REPORT

2.8.26

 Threat H1 2026 December 2025 – May 2026 Report Welcome to the H1 2026 issue of the ESET Threat Report! REPORT REPORT

25.7.26

 DevMan Ransomware
Threat Actor Report		 In early April 2025, an actor presenting itself as “DevMan” has claimed on X1 to gain access and perform a ransomware attack against the French transport company “doumen”. Since then, the threat actor has proved itself as being highly prolific and was named as one of the top active ransomware attackers in the following months.2 As of July 2025, DevMan has claimed at least 54 victims. REPORT REPORT

25.7.26

 Cybercrime in the age of AI AI is rewiring the cybercrime ecosystem. You have six months to prepare. REPORT REPORT

24.7.26

 Disrupting the first reported AI-orchestrated cyber espionage campaign We have developed sophisticated safety and security measures to prevent the misuse of our AI models. While these measures are generally effective, cybercriminals and other  malicious actors continually attempt to find ways around them. REPORT REPORT

24.7.26

 ClickFix Campaigns Targeting Windows and macOS Insikt Group identified five distinct ClickFix clusters sharing the same core human-verification lure despite notable differences in themes, delivery patterns,
and infrastructure.		 REPORT REPORT

24.7.26

 TAG-195 Upgrades MaaS Ecosystem with Modular Tools Insikt Group identified four new TAG-195 malware families that indicate sustained  active development and a deliberate architectural transition toward modular,  operator-driven tooling. REPORT REPORT

24.7.26

 Russian State-Supported Cyber Actors  Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian statesupported advanced persistent threat (APT) group’s activity is tracked in the cybersecurity community under several names (see Cybersecurity industry tracking), primarily as “LAUNDRY BEAR,” a name initially coined by the Netherlands General Intelligence and Security Service (AIVD) and Defence Intelligence and Security Service (MIVD). REPORT REPORT

21.7.26

 Anatomy of a Cyber World Effectively prioritize your investment in cybersecurity through understanding your adversaries and the attack methods targeting your industry and region REPORT REPORT

21.7.26

 Considering Simultaneous Voltage-Sensitive Load Reductions Operators and planners of the Bulk Electric System (BES) should be aware of the risks and challenges associated with voltage-sensitive large loads that are rapidly being connected to the power system. Specifically, when considering data centers and cryptocurrency mining facilities, entities should be aware of the potential for large amounts of voltage-sensitive load loss during normally cleared faults on the BES REPORT REPORT

20.7.26

 Russian state actors are compromising IP cameras in Europe for military purposes Cybersecurity advisory Russian state actors are compromising IP cameras in Europe for military purposes REPORT REPORT

18.7.26

 GTIG AIThreat Tracker: Advances in Threat Actor Usage of AI Tools Advances in Threat Actor Usage  of AI Tools REPORT REPORT

18.7.26

 m-trends-2026-en m-trends-2026 REPORT REPORT

18.7.26

 AI Security
Report 2026		 AI SecurityReport 2026 Check Point AI Report • 2nd Annual EditionCheck Point Research AI Security Report 202 REPORT REPORT
1.7.26 Global Incident Response Report 2026 While these four trends each present a challenge, attacker success is rarely determined by a single attack vector. In more than 750 incident response (IR)  engagements, 87% of intrusions involved activity across multiple attack surfaces. This means defenders must protect endpoints, networks, cloud infrastructure, SaaS applications and identity together. REPORT REPORT
1.7.26 Microsoft Digital Defense Report 2025 Lighting the path to a secure future REPORT REPORT
1.6.26 ESET APT Activity Report Q4 2025–Q1 2026 CONFLICT-INFORMED ESPIONAGE: MONITORING OIL SHIPMENTS, TARGETING DRONE MAKERS REPORT REPORT
29.5.26 5 EUROPEAN THREAT LANDSCAPE REPORT Europe’s cyber threat actors are accelerating. eCrime adversaries, state-backed operators, and hacktivists are conducting faster intrusions, employing new social engineering tradecraft, and operating resilient criminal ecosystems. REPORT REPORT
28.5.26 State of AI in the Cloud 2026 How AI Adoption, Autonomy, and Attacker Innovation Are Reshaping Cloud Security REPORT REPORT
23.5.26 2026Microsoft Vulnerabilities Report13th Edition Data-packed insights and expert analysis to help you mitigate security risks in your Microsoft estate. REPORT REPORT
14.5.26 APT ActivityApril 2025 – September 2025
Report		 RUSSIA-ALIGNED APTs RAMP UP ATTACKS AGAINST UKRAINE AND ITS STRATEGIC PARTNERS REPORT REPORT
11.5.26 ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure The Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) has observed ClickFix associated activity leveraging WordPress hosted infrastructure to distribute the Vidar Stealer malware. REPORT REPORT
11.5.26 Acronis Cyberthreats Report, H2 2025: From exploits to malicious IA The Acronis Cyberthreats Report covers the global threat landscape as encountered by the Acronis Threat Research Unit (TRU) and Acronis sensors in the second half of 2025. General threat data (including malware, ransomware, web and email threats, vulnerabilities, etc.) presented in the report is gathered from January–December of 2025 and reflects threats targeting endpoints we observed in this time frame. REPORT REPORT
11.5.26 State of the SOFTWARE SUPPLY CHAIN 2026 The Limits of Legacy Vulnerability Management REPORT REPORT
11.5.26 FEMITBOT Abuse of Telegram Mini Apps for Large-Scale Fraud Campaigns REPORT REPORT
5.5.26 Zscaler ThreatLabz 2026 VPN Risk Report For decades, VPN was the default answer to remote access security – reliable, familiar, and deeply embedded in enterprise architecture. That era is ending. AI has accelerated attack timelines from weeks to minutes, automated credential theft at industrial scale, and given adversaries a speed advantage that human-led defense cannot match. REPORT REPORT
28.4.26 DSCI THREAT INTELLIGENCE AND RESEARCH INITIATIVE DSCI THREAT INTELLIGENCEAND RESEARCH INITIATIVETHREAT REPORTII FEBRUARY 2026 REPORT REPORT
26.4.26 The State of BCDR 2025: Future-Proof Your Data Protection Strategies Data is the backbone of every business, driving innovation, decision-making and customer engagement. Whether you’re an MSP protecting client environments or an internal IT professional securing your organization’s infrastructure, ensuring data availability and security is both a critical responsibility and a strategic advantage. REPORT REPORT
22.4.26 Assessment | Q1 2026 Ransomware Wrap-Up
A-2026-04-17a		 ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. REPORT REPORT
12.4.26 Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US
Critical Infrastructure		 REPORT REPORT
9.3.26 Cloud Threat Horizons Report H1 2026 The Google Cloud Threat Horizons Report provides decision-makers with strategic intelligence on threats to not just Google Cloud, but all cloud service providers. REPORT REPORT
27.2.26 CISCO SD-WAN THREAT
HUNT GUIDE		 The authors are aware that since 2023, at least one malicious cyber actor compromised Cisco SD-WANs via a previously unknown vulnerability, identified in late 2025 to be a zeroday exploit. This vulnerability is now patched in the latest updates from the vendor. REPORT REPORT
20.2.26 Ninja Browser & Lumma Infostealer CTM360 has identified a large-scale malware campaign exploiting trusted Google services — including Google Groups, Google Docs, and Google Drive — to distribute Lumma Stealer and a trojanized Chromium-based “Ninja Browser.” REPORT REPORT
10.1.26 BlueDelta’s Persistent
Campaign Against UKR.NET		 Between June 2024 and April 2025, Recorded Future’s Insikt Group identified a sustained
credential-harvesting campaign targeting users of UKR.NET, a widely used Ukrainian webmail and news
service		 REPORT REPORT
10.1.26 GRU-Linked BlueDelta Evolves
Credential Harvesting		 Between February and September 2025, Recorded Future’s Insikt Group identified multiple credential-harvesting campaigns conducted by BlueDelta, a Russian state-sponsored threat group associated with the Main Directorate of the General Staff of the Armed Forces of the Russian Federation (GRU). REPORT REPORT
3.1.26 OWASP Top 10 For Agentic Applications 2026 The information provided in this document does not, and is not intended to, constitute legal advice. REPORT REPORT