Quick Summary
The Picus Security Red Report 2026 reveals a shift in cyberattack strategies, with attackers focusing on stealth and persistence rather than disruptive ransomware. This change is evidenced by a 38% decline in data encrypted for impact, dropping from 21% in 2024 to 12.94% in 2025. Attackers are increasingly using identity-based access and low-noise techniques, allowing them to operate undetected within organizations, which poses significant risks to cybersecurity and privacy.
The Securityish Brief
The Picus Security Red Report 2026 highlights a significant evolution in cyberattack strategies, moving away from traditional ransomware tactics towards stealthy, persistent intrusions. This shift is characterized by a focus on identity-based access and low-noise execution, allowing attackers to blend into legitimate activity without raising alarms. The report analyzed over 1.1 million malicious files and 15.5 million adversarial actions, revealing that 80% of the top 10 MITRE ATT&CK techniques are now geared towards evasion and persistence.
As attackers adapt to defenders’ weaknesses, the Blue Report 2025 indicates that while 54% of attacker activity is logged, only 14% generates alerts. This visibility gap enables intrusions to persist undetected, with attackers exploiting trusted environments and legitimate channels for data exfiltration. The report notes a concerning decline in data exfiltration prevention, dropping from 9% to just 3%, making it the least prevented attack vector.
Credential theft remains a central tactic, with credentials from Password Stores appearing in 23.49% of attacks. This indicates a strategic move towards quieter entry points, as attackers increasingly succeed in environments where valid accounts are rarely stopped after an initial compromise. The Blue Report 2025 found that valid accounts succeeded in 98% of tested environments, underscoring the critical role of identity in modern cyberattacks.
Understanding the Digital Parasite
The term ‘Digital Parasite’ describes this new intrusion model, prioritizing long-term presence over immediate disruption. As ransomware signals fade, attackers are focusing on silent data theft, which allows systems to remain operational while extracting value over extended periods. The Red Report shows a 38% year-over-year decline in data encrypted for impact, reflecting a shift in attacker economics from locking data to quietly stealing it.
Modern malware is also evolving, with techniques like Virtualization and Sandbox Evasion climbing into the top five attacker techniques. This allows malware to avoid execution during analysis, making detection increasingly challenging. The report indicates that T1497 is successfully prevented only 13% of the time, highlighting the need for organizations to adapt their defenses to these evolving threats.
To effectively counter these threats, organizations must adopt a threat-informed defense strategy that continuously tests their controls against real adversary behavior. The Red Report emphasizes the importance of validating defenses against prevalent ATT&CK techniques, as true cyber resilience depends on regularly assessing control effectiveness through adversarial exposure validation.
- Data Encrypted for Impact (T1486): This technique has seen a decline from 21.00% in 2024 to 12.94% in 2025.
- Valid Accounts (T1078): This technique succeeded in 98% of tested environments, indicating the effectiveness of credential-based access.
- Credentials from Password Stores (T1555): This technique appeared in 23.49% of attacks, showcasing the shift towards quieter entry points.
- Virtualization and Sandbox Evasion (T1497): This technique is now among the top five, with only 13% prevention success.
- Data Exfiltration Prevention: This measure has collapsed from 9% to just 3%, making it the least prevented attack vector.
Key Takeaways
- Regularly validate your security controls against the most prevalent ATT&CK techniques to ensure they can detect and block stealthy attacks.
- Monitor for unusual access patterns and credential usage to detect potential identity-based intrusions early.
- Implement robust data exfiltration prevention measures to address the significant drop in effectiveness noted in the Blue Report 2025.
- Educate employees on recognizing legitimate versus suspicious activity to enhance overall organizational awareness.
- Conduct regular breach and attack simulations to test your defenses against modern, stealthy attack techniques.
Key Terms & Concepts
- Digital Parasite: In this article, the Digital Parasite refers to a new intrusion model prioritizing stealth and long-term presence over immediate disruption.
- MITRE ATT&CK: MITRE ATT&CK is a framework that categorizes the tactics and techniques used by cyber adversaries.
- Data Encrypted for Impact (T1486): This technique involves encrypting data to disrupt operations, which has seen a significant decline in usage.
- Valid Accounts (T1078): This technique involves using legitimate credentials to gain unauthorized access, succeeding in 98% of tested environments.
- Virtualization and Sandbox Evasion (T1497): This technique allows malware to avoid detection by not executing during analysis in virtual environments.
Read the original article here: https://www.helpnetsecurity.com/2026/02/18/picus-security-red-report-identity-driven-cyberattacks/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
