Cyber crime no longer resembles the chaotic hacking culture many people still imagine. It operates like a mature industry with pricing models, supply chains and repeatable processes.
That’s one of the central messages in the Huntress 2026 Cyber Threat Report, which draws on telemetry from millions of endpoints and identities monitored by the Huntress Security Platform and its 24/7 SOC.
The report offers a clear picture of how attackers actually operate today and why many organisations are struggling to keep up.
Cybercrime now runs like a business
Attackers are not simply opportunistic criminals anymore. They are organised, specialised and increasingly efficient.
The report describes cyber crime as an underground industry with its own infrastructure, pricing models and even refund policies.
Threat actors scale their operations using automation, legitimate IT tools and well-tested playbooks. Instead of inventing new techniques every time, they repeat what works.
That operational maturity is why attacks are becoming faster and harder to detect.
Trusted tools are becoming attack tools
One of the most notable trends highlighted in the report is the growing abuse of legitimate software.
Remote monitoring and management (RMM) tools, commonly used by IT teams, are increasingly used by attackers to maintain persistence and move through networks.
Because these tools are legitimate and widely trusted, their activity can blend in with normal operations.
The report notes that malicious RMM use surged across multiple sectors, with healthcare and technology experiencing the largest increases.
This shift toward living-off-the-land techniques allows attackers to remain hidden for longer while they escalate access.
Healthcare, education and manufacturing remain major targets
Cyber criminals are not attacking industries at random. They target sectors where disruption creates leverage.
According to the report, healthcare and education together accounted for 37% of observed incidents, with healthcare becoming the most targeted sector at 21% of attacks.
Manufacturing has also become an increasingly attractive target.
Production environments often have minimal tolerance for downtime, which makes them more vulnerable to extortion. Even short interruptions can create significant financial losses.
Ransomware is changing shape
Ransomware continues to evolve.
While it represents a smaller percentage of total incidents in 2025, the volume of ransomware activity increased year-on-year.
The report also notes that ransomware operations are becoming concentrated among a small number of highly organised groups.
Four groups, Akira, Medusa, Qilin and RansomHub, collectively accounted for over half of ransomware incidents observed.
Rather than developing entirely new methods, many of these groups now rely on a standardised “common playbook” built around proven attack chains.
Typical stages include:
Credential theft
System-level persistence
Shadow copy deletion
Data exfiltration and encryption
These predictable patterns can help defenders detect attacks earlier, if monitoring is in place.
Attackers are using AI – but not always well
AI is also beginning to appear in attacker tooling.
In earlier phases this largely meant generating phishing emails. But the report shows experimentation expanding into more practical applications.
Examples include:
AI-generated scripts for credential dumping
AI-assisted reconnaissance and vulnerability discovery
Deepfake impersonation of executives during video calls
Malicious instructions embedded in shared AI chat links promoted via search ads
Interestingly, the report notes that AI-generated tools sometimes reveal their origins through tell-tale signs such as incomplete functionality or unusual comments in code.
Still, the main advantage AI gives attackers is speed – reducing the time needed to prepare and launch attacks.
The real takeaway
Perhaps the most important insight in the report is this:
Attackers succeed by repeating proven techniques.
They rely on predictable playbooks, legitimate tools and stolen credentials.
Which means defenders don’t necessarily need to guess the next new threat. They need visibility across the entire attack path and the ability to respond quickly when suspicious activity begins.
That’s the difference between discovering an attack early and discovering it after the damage is done.
Want to see how this looks in your environment?
At Black Swan Cyber Security Solutions, we partner with Huntress to deliver 24/7 threat detection and response for endpoints and Microsoft 365 environments.
The same telemetry and threat intelligence used in the Huntress Cyber Threat Report comes from their global platform, which currently helps protect millions of endpoints and identities worldwide.
For many small and medium organisations, the biggest challenge isn’t buying security tools, it’s having the people and visibility needed to detect and respond to threats quickly.
That’s where Huntress comes in.
Their platform combines:
24/7 monitoring by a managed Security Operations Centre
Human-led threat investigation and response
Through our partnership with Huntress, we can help organisations deploy and manage this protection without needing an in-house security team.
If you’re curious how it works in practice, we’re happy to help.
You can:
Request a live demo
Start a trial
Or simply have a conversation about your current security posture
Get in touch with the team at Black Swan Cyber Security Solutions to learn more.
