The CrowdStrike Global Threat Report 2026 reveals that cyberattackers are growing faster and becoming harder to detect as AI reshapes the threat landscape.
In 2025, criminal and state-sponsored threat actors set new records for speed, scale, and evasion. The average intrusion went from initial access to lateral spread in under 30 minutes. AI accelerated attacks across every stage of the kill chain, and the systems organizations use to deploy AI became targets in their own right.
For years, security researchers have warned that attackers are becoming faster and more elusive. The data compiled by CrowdStrike for the CrowdStrike Global Threat Report 2026 across 2025 shows how far that shift has progressed. The average time for a criminal actor to move laterally after gaining a foothold — the so-called breakout time — fell to 29 minutes last year, a 65 percent reduction from 2021 and nearly double the pace recorded in 2024. In the fastest recorded incident, lateral movement began just 27 seconds after initial access. In a separate intrusion, data exfiltration started within four minutes.
These figures reflect a structural change in how intrusions unfold rather than isolated outliers. Threat actors are compressing every phase of an attack — from reconnaissance to exfiltration — by automating steps that previously required human time. The window in which a defender can detect, assess, and respond has narrowed to the point where manual workflows are frequently outpaced.
AI Integrated Across the Attack Lifecycle
Artificial intelligence featured across nearly every phase of malicious activity observed in 2025. The number of attacks attributed to AI-enabled adversaries rose 89 percent year-on-year. Threat actors used large language models to draft phishing content, translate social engineering lures into target languages, generate post-exploitation scripts, and create or obfuscate malware. One Russia-linked group deployed a Python-based tool that queried an open-weight LLM at runtime to generate reconnaissance commands, feeding its outputs directly into live operations.
Less sophisticated actors benefited disproportionately. AI tools allowed groups with limited technical depth to produce functional malware and credible social engineering at a scale previously beyond their reach — though analysts noted that these actors often introduced errors when implementing AI-generated outputs, sometimes undermining their own operations. For the most capable groups, the gains were different: AI accelerated development cycles, reduced manual overhead in post-exploitation, and enabled parallel operations across multiple targets.
AI systems themselves became targets. A code injection flaw in Langflow, a platform used to build AI agents, was exploited to deploy ransomware across dozens of environments. Attackers published a counterfeit Model Context Protocol server that silently forwarded users’ emails to attacker-controlled addresses. In one supply chain incident, malicious packages uploaded to the Node Package Manager ecosystem contained code designed to invoke victims’ own local AI tools — including Claude and Gemini — to generate commands for stealing credentials and cryptocurrency.
Evasion through Legitimacy
Eighty-two percent of detections recorded in 2025 were malware-free — meaning attackers achieved their objectives without deploying traditional malicious code. Instead, they operated through valid credentials, approved software, and authorised authentication flows. Identity became the primary attack surface. Valid account abuse accounted for 35 percent of cloud incidents. AI-enabled adversaries increased their activity by 89%. Russia-nexus FANCY BEAR deployed LLM-enabled malware (LAMEHUG) to automate reconnaissance and document collection. eCrime actor PUNK SPIDER used AI-generated scripts to accelerate credential dumping and erase forensic evidence, and DPRK-nexus FAMOUS CHOLLIMA leveraged AI-generated personas to scale insider operations. DPRK-linked incidents rose more than 130% as FAMOUS CHOLLIMA activity more than doubled. PRESSURE CHOLLIMA’s $1.46B cryptocurrency theft was the largest single financial heist ever reported.
The pattern extended to how initial access was obtained. Voice phishing — calling help desk personnel and persuading them to perform password resets — remained a reliable entry vector for ransomware groups. Once inside, attackers sought unmanaged systems: decommissioned virtual machines, unpatched webcams, network appliances without endpoint detection coverage. From these blind spots, they encrypted files on adjacent managed hosts via Server Message Block shares without ever touching a monitored endpoint directly.
Supply chain compromise extended the same logic to software ecosystems. Rather than attacking organisations directly, threat actors increasingly targeted the upstream code and services those organisations depend on. North Korea-linked actors deployed more than 30 malicious packages to npm between January and May 2025, using fake recruiter personas to persuade developers into running them. A separate actor compromised multiple npm packages with a combined two billion weekly downloads after phishing the account credentials of a single prolific developer.
China and the Race to Exploit New Vulnerabilities
China-linked groups accounted for some of the most consistent and technically demanding activity of the year. Overall intrusion volume attributed to these actors increased 38 percent against 2024 figures, with particularly sharp rises in attacks on logistics (up 85 percent) and telecommunications (up 30 percent). The targeting patterns align closely with priorities laid out in China’s 14th Five-Year Plan — intelligence collection against sectors holding strategic economic or communications value.
A recurring feature of these operations was the speed at which newly disclosed vulnerabilities were weaponised. In three separate cases documented during 2025, Chinese-linked groups moved from public vulnerability disclosure to active exploitation within two to six days. In one instance, a group exploited a file upload flaw three days after vendor disclosure; in another, a SQL injection vulnerability was used six days after a proof-of-concept exploit was published publicly. Analysts assess that this pace reflects dedicated internal resources for vulnerability monitoring rather than opportunistic activity.
The preferred entry points were network perimeter devices — VPN appliances, firewalls, gateways — which offer broad access to internal networks while typically operating with minimal endpoint detection coverage and inconsistent patching. In one long-running intrusion, a group maintained persistent access for 22 months before detection. Zero-day exploitation overall rose 42 percent year-on-year across all actor types, continuing a multi-year upward trend.
What Defenders Face in 2026
The conditions that made 2025 difficult for defenders show no sign of easing. Cloud-conscious intrusions rose 37 percent over the year, with state-linked actors increasing their cloud targeting activity by 266 percent. SaaS applications — particularly customer relationship management platforms — emerged as a priority target as organisations migrated more sensitive data off-premises. Ransomware groups and intelligence-collection actors alike exploited the fact that these platforms are often monitored less rigorously than internal infrastructure.
The integration of AI into enterprise workflows is expanding the attack surface further. As organisations embed AI agents into operational processes, those agents become potential points of compromise — either through prompt injection or by being co-opted to execute commands on behalf of an attacker. The asymmetry between offensive and defensive AI adoption is currently widening: attackers face few constraints on how they deploy these tools, while defenders must navigate procurement cycles, compliance requirements, and organisational change.
The headline figures from 2025 — 27-second breakout times, 89 percent more AI-enabled attacks, 42 percent more zero-days exploited before public disclosure — are less useful as isolated statistics than as indicators of direction. The trajectory is toward faster, more automated, and harder-to-attribute intrusions conducted through channels that look, to conventional monitoring tools, like legitimate activity. Closing that gap will require defenders to operate at similar speeds and with similarly integrated intelligence.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de