The Year of the Evasive Adversary: Key Takeaways from the CrowdStrike 2026 Global Threat Report

Adversaries Are Leveraging AI to Enhance and Accelerate Attacks 

Artificial intelligence is no longer just a defensive tool, adversaries are actively weaponizing AI to enhance attack scale, speed, and effectiveness, and the data supports it. 

An 89% increase in attacks by AI-enabled adversaries year-over-year was noticed this year, with threat actors using AI to accelerate phishing, generate malware, produce post-exploitation scripts, and fabricate convincing fake personas for social engineering. 

Attackers are increasingly targeting AI systems directly by exploiting vulnerabilities in development platforms, deploying malicious MCP servers that impersonate legitimate services, and introducing poisoned packages designed to hijack AI tooling and extract credentials. As organizations adopt AI, these platforms and their integrations must be treated as part of the enterprise attack surface. 

Ransomware Adversaries Are Expanding Cross-Domain Tradecraft 

Big Game Hunting (BGH) ransomware groups remained the dominant eCrime threat in 2025, but their tactics have shifted away from traditional endpoint-based attacks. 

Sophisticated threat groups such as SCATTERED SPIDER, BLOCKADE SPIDER, and PUNK SPIDER are deliberately operating in areas with limited or no EDR coverage, including unmanaged VMs, VMware ESXi infrastructure, SaaS applications, and cloud environments, enabling data encryption and exfiltration without interacting with managed endpoints. 

PUNK SPIDER alone conducted 198 intrusions in 2025, a 134% year-over-year increase. The core lesson is clear: fragmented visibility across tools and teams creates the exact conditions adversaries are designed to exploit. 

China-Nexus Threat Actors Are Targeting Network Perimeter Devices 

China-linked adversaries increased activity by 38% in 2025, with a clear preference for internet-facing perimeter devices like VPNs, firewalls, and gateways—systems where patching is often inconsistent. 

Exploitation timelines are measured in days, not weeks, with actors weaponizing new vulnerabilities within 2 to 6 days of disclosure and maintaining access for up to 22 months in some cases. 

Logistics (up 85%), telecommunications (up 30%), and financial services (up 20%) were the most targeted sectors, and CrowdStrike expects this edge-focused strategy to continue into 2026. 

Supply Chain Attacks Are Enabling Evasion of Traditional Security Controls 

Rather than targeting organizations directly, adversaries in 2025 increasingly compromised upstream software providers, development ecosystems, and trusted code repositories. 

A notable example is North Korea-linked PRESSURE CHOLLIMA, which executed the largest cryptocurrency theft in history, stealing $1.46 billion by compromising a developer workstation, pivoting into a wallet platform’s cloud environment, and covertly redirecting transactions to an attacker-controlled wallet, all through trusted software paths. 

These attacks weaponize trust in legitimate software, allowing malicious activity to operate under the guise of authenticity and evade detection without robust code signing, dependency validation, and third-party risk controls. 

Zero-Day Exploitation Is Rising Across All Threat Actor Types 

CrowdStrike observed a 42% year-over-year increase in zero-day vulnerabilities exploited before public disclosure in 2025, continuing a multi-year upward trend. 

Nation-state actors continue to prioritize zero-day vulnerabilities in edge devices and public-facing infrastructure to establish long-term persistence, while financially motivated groups target internet-facing enterprise applications to maximize data exfiltration at scale. 

With exploitation timelines shrinking, aggressive patching cadences, proactive threat hunting, and cross-domain detection capabilities are critical to reducing exposure before adversaries can act. 

Adversaries Are Subverting Trust in Cloud Platforms and Services 

Cloud-conscious intrusions increased by 37% in 2025, with adversaries increasingly bypassing traditional compromise methods in favor of identity-centric techniques. 

Adversaries are exploiting trust in cloud identity systems, SaaS integrations, and authentication flows by leveraging valid credentials, compromised identity providers, and stolen OAuth tokens to gain access without triggering traditional intrusion signals. 

Valid account abuse accounted for 35% of all cloud incidents. Groups like SCATTERED SPIDER and BLOCKADE SPIDER targeted hybrid identity solutions to gain enterprise-wide privileged access, while Russia-linked COZY BEAR ran elaborate multi-channel social engineering campaigns directing victims to enter credentials on legitimate Microsoft login pages.