In early 2026, a React2Shell honeypot purpose-built by Darktrace analysts was compromised in less than two hours after deployment. That single data point captures the pace of the threat landscape in the first half of 2026, but speed tells only part of the story.

The shift over the past six months has moved away from traditional malware and vulnerability-centric attacks and toward the abuse of trusted identities, platforms, and infrastructure. Identities, Software-as-a-Service (SaaS) platforms, cloud entitlements, automation frameworks, and non-human identities have become the preferred attack paths as organizations adopt AI at scale.

Attackers are increasingly operating inside the relationships, services, and authenticated channels that defenders and users are conditioned to rely on, rather than breaking in from the outside.

What has changed since 2025?

In 2025, identity became the new perimeter as attackers increasingly bypassed traditional exploitation in favor of trusted accounts, SaaS platforms, and emerging AI-enabled tradecraft. The first half of 2026 marks the next stage of that evolution. Identity remains central, but the trust challenge now extends far beyond accounts to email authentication, cloud entitlements, software supply chains, AI gateways, remote administration tooling, and non-human identities.

Identity and email: trust signals under pressure

Email remains the most reliable route to a trusted identity, and the data shows attackers investing in quality over noise. In the first half of 2026, 67% of phishing emails passed DMARC[PC1] [NJ2] . Authentication alone is no longer sufficient to stop most phishing attempts. VIP users were targeted in 25.8% of phishing, consistent with 2025's “over 25%” figure, but drifting upward throughout the period. Crucially, phishing sophistication continued to increase: 37% of phishing contained a high volume of text, up from 32% in the first half of 2025, while 39% featured novel social engineering techniques, suggesting attackers are further customizing to specific targets.

The most prevalent threats affecting Darktrace customers were also among the most identity-centric: information stealers, with dedicated StealC and AMOS campaigns running through the half-year. Their prevalence is, fundamentally, an identity story. Credentials harvested by infostealers often become the initial access vector for far higher-impact intrusions later in the attack chain. Crucially, the delivery method rarely requires exploitation of a technical weakness. ClickFix social engineering, which tricks users into running malicious code themselves, remained a common distribution route. One recent campaign impacted Darktrace customers across 17 countries, with the United States the most affected. The compromise did not begin with a software flaw, but with a trusted user taking a trusted action.

Supply chain: Trust weaponized at scale

March and April reinforced the same lesson: trust has become a supply-chain vulnerability. The Axios compromise abused trust in a widely used maintainer, while the Trivy campaign leveraged trusted CI/CD infrastructure, release artifacts, and container images to push malicious code through legitimate development workflows.

The clearest example was a February–March campaign in which devices downloaded malicious payloads while using Hola VPN, later linked to an issue within Hola's own delivery pipeline. Darktrace's Threat Research team identified associated activity through recurring anomalous behavior across multiple customers before a public advisory was released.

More recently, attackers abused legitimate blockchain infrastructure to distribute infostealers, including AMOS and Phexia. Popular tools like VPNs, often used by users with limited security resources, combined with legitimate command-and-control (C2) infrastructure enables attackers to reach a far wider victim base while frustrating defenders who cannot simply block the associated endpoints.

For defenders, the challenge is no longer identifying malicious infrastructure, but recognizing when trusted infrastructure begins behaving maliciously.

Cloud and SaaS: from target to terrain

Through May and June, activity involving device registration, cloud data theft, SaaS abuse, RDP expansion, and remote management tooling suggested that attackers increasingly view cloud and SaaS not simply as targets, but as their preferred operating environment.

In one Darktrace case a single compromised SaaS account triggered activity across email, SaaS, and network layers, including inbox rule changes, phishing propagation, and connections to suspicious infrastructure. None of these indicators were decisive in isolation, but together they revealed a clear intrusion. Increasingly, attackers do not need to bypass trust controls in these environments; they inherit them through compromised identities, delegated access, and legitimate administration tools. This is the natural progression of 2025's SaaS-targeted ransomware trend: the platforms on which businesses operate are increasingly the same platforms on which adversaries operate.

AI: accelerant, attack surface, and trusted but risky actor

If trust is the attack surface, AI is where that surface is expanding fastest. Across the Darktrace customer base, AI service connections per deployment rose 13% in the first half of 2026, surpassing 16 million connections, while the typical organization now interacts with seven different AI providers. AI is no longer at the edge of the enterprise; it is embedded in day-to-day business operations. That shift creates three distinct problems, all of which were observed by Darktrace in the first half of 2026.

1. AI as an attack multiplier

Darktrace identified AI-generated malware exploiting React2Shell, in which an attacker used an LLM to produce working exploit code and deploy it at scale. Similar activity is increasingly appearing across the wider threat landscape, suggesting that the barrier to effective offensive operations is collapsing. As demonstrated by the recent JadePuffer case, in which an agentic threat actor exploited a vulnerability in an internet-facing server before launching a fully automated ransomware attack, AI is accelerating the path from vulnerability disclosure to operational exploitation [1].

2. AI as an attack surface

The AI layer itself is now worth probing. At an automation technology manufacturer, a compromised LLM proxy was used as a steppingstone toward additional AI services; when that failed, the attacker pivoted to cryptomining. Darktrace’s Cyber AI Analyst pieced the intrusion together and Darktrace’s Managed Threat Detection service alerted the customer, containing it before it could progress further. The practitioner lesson is clear: treat AI gateways, proxies, and model endpoints as production cloud workloads because attackers already do.

3. AI as a trusted but potentially risky actor

Darktrace / SECURE AI observations suggest the most common real-world risk is quieter still: employees entering personal identifiable information (PII), tax records, identity documents, company financial data, HR records, and personal medical data into LLM prompts, alongside widespread shadow AI use and increased AI usage from mobile devices. Across nearly 280,000 prompts submitted by almost 28,000 users over 28 days, Darktrace identified that approximately 1% of these prompts (or 2,945 instances) contained sensitive data*.

_{*Prompt data was analyzed in aggregate and anonymized form to protect user privacy.}

‍

For defenders, the challenge is context: knowing when legitimate business use crosses into material risk without breaking privacy or user trust. As organizations increasingly trust AI systems to access, process, and share sensitive information at machine speed, AI must be secured and monitored alongside identities, applications, and cloud infrastructure.

Speed and geopolitics: faster operations, longer-term objectives

Several investigations in the first half of the year showed how quickly attackers operationalize newly disclosed vulnerabilities, validating exploitation through Out-of-Band Application Security Testing (OAST) infrastructure and trusted cloud services before patching cycles can be completed. React2Shell was compromised in two hours, while BeyondTrust exploitation followed in less than a day. Against this backdrop, state-aligned actors continue to prioritize long-term access, intelligence collection, and pre-positioning through legitimate services, cloud infrastructure, and trusted relationships. Operations linked to China, Russia, Iran, and the Democratic People’s Republic of Korea (DPRK) shared a common characteristic: a focus on persistence and strategic positioning rather than immediate disruption.

China: Darktrace observed Chinese-nexus actors prioritizing long-term access through trusted services, dynamic-link library (DLL) sideloading, and modular intrusion chains consistent with activity documented in Crimson Echo reporting and associated with Twill Typhoon tradecraft.

Iran: Darktrace's ZionSiphon investigation highlighted Iranian-linked interest in operational technology (OT) environments, blending espionage objectives with infrastructure disruption capabilities.

Russia: Darktrace investigations, alongside wider industry reporting, highlighted Russian reliance on trusted relationships and supply-chain targeting for long-term intelligence on Ukraine related support [2].

DPRK: Darktrace observed DPRK-linked activity combining rapid vulnerability weaponization with persistent access techniques, including Axios supply-chain compromise, React2Shell exploitation and stealthy macOS intrusions

While objectives differed across actors, the tradecraft was remarkably consistent: trusted services, legitimate infrastructure, and persistent access remained more valuable than immediate disruption.

The defender shift

Across identity compromise, supply-chain attacks, SaaS abuse, AI infrastructure targeting, and state-aligned operations, attackers increasingly succeed by operating through trusted systems rather than breaking through defensive controls. Trusted users, trusted software, trusted infrastructure, and increasingly trusted AI systems all became viable attack paths.

For defenders, the challenge is no longer simply determining whether an action is allowed; it is determining whether that action makes sense in its wider context. Authentication, reputation, and provenance remain important, but they are no longer sufficient on their own. As attackers increasingly operate within trusted systems, the strongest signal is often a behavioral deviation: identifying when trusted activity no longer aligns with expected behavior.

‍

Credit to Nathaniel Jones (SVP, Global Threat Intelligence), Emma Foulger (Global Threat Research Operations Lead), Justin Torres (Senior Cyber Analyst), Daniel Levy (Threat Hunting Data Scientist)

‍
Edited by Ryan Traill (Content Manager)

‍

Appendix 1: Threat Research Methodology

Darktrace’s Threat Research team conducts extensive research across customer deployments to identify active threats, pinpoint key Indicators of Compromise (IoCs), and provide relevant threat intelligence. This research leverages Darktrace’s anomaly-based detection and involves thorough analysis and contextualization by the Threat Research team. Detected threats are promptly reported to the relevant customer security teams. When a customer has Darktrace’s Autonomous Response technology enabled, these threats are swiftly mitigated to prevent escalation.

Between January 1 and June 30, 2026, Darktrace investigated a wide range of cyber threats across its customer base. Many were identified as campaign-like activities targeting multiple customers, where clusters of similar tactics, techniques, and procedures (TTPs) and IoCs were seen affecting a significant number of customers within a short timeframe.

Statistics related to email are derived from aggregated Darktrace / EMAIL data across all cloud-hosted customer deployments between January 1 and June 30, 2026. Standard data-quality filtering was applied to exclude anomalous observations prior to aggregation. Regional statistics are based on relevant subsets of this dataset.

‍

Appendix 2: Campaigns - Regional and Sector Trends

While the above broad themes defined the threat landscape over the last six months, campaign clustering across the Darktrace customer base revealed how they manifested differently across sectors, regions, and industries.

Darktrace’s Threat Research team investigates a range of threats affecting its customer base. Through this research, campaign-like clusters of activity have been identified, in which common tactics, techniques, and procedures (TTPs), as well as infrastructure, are observed impacting a significant number of customers within a short timeframe.

Sectors and industries are classified using the Standard Industrial Classification (SIC) system to ensure consistent categorization. While the sector and regional insights in this report reflect broader global trends, they are also influenced by the distribution of Darktrace's customer base. For example, Finance, Manufacturing, and Education are strongly represented among Darktrace customers, which may result in a higher number of observed cases in these sectors. This reflects customer distribution rather than necessarily indicating elevated sector-specific risk. Similarly, regional trends may be influenced by the geographic distribution of Darktrace customers.

‍

Analysis of campaign clusters identified by the Darktrace Threat Research team during the first half of 2026 revealed distinct regional trends.

• Europe, Middle East & Africa (EMEA) dominated with 60% of all campaign cluster cases targeting this region.
• The Americas (AMS) was the next most affected region, with 30% of campaign cluster cases.
• The Asia-Pacific and Japan (APJ) region was less affected by campaign clusters, potentially indicating that threat actors placed a lower priority on the region and instead focused their efforts elsewhere.

Sector targeting also varied considerably by region:

• In EMEA, the Information and Communication was the most affected by a significant margin, representing 25% of all cases.
• In contrast, AMS targeting was more evenly distributed, with the Education, Public administration and defence, and Financial Insurance activities sectors all forming over 20% of AMS regional cases.
• Across APJ, campaign activity was spread more equally, with no single sector emerging as a dominant target.

‍

Several countries also stood out within their respective regions:

• The United States accounted for 60% of all campaign clusters within AMS.
• Japan represented 40% of campaign customer cases across APJ.
• In EMEA, the United Kingdom and Zimbabwe each accounted for 23% of identified cases, both being involved in a variety of campaign types.

‍

Inside the SOC & Threat Research 2026 Monthly Progression: From Access to Impact

Appendix 3: Bibliography

External

[1] https://www.darkreading.com/cyberattacks-data-breaches/jadepuffer-first-complete-llm-driven-ransomware-attack

[2] https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html

Darktrace Reading

1.        https://www.darktrace.com/blog/ai-llm-generated-malware-used-to-exploit-react2shell

2.        https://www.darktrace.com/blog/2025-cyber-threat-landscape-darktraces-mid-year-review

3.        https://www.darktrace.com/resources/annual-threat-report-2026

4.        https://www.darktrace.com/blog/when-trust-becomes-the-attack-surface-supply-chain-attacks-in-an-era-of-automation-and-implicit-trust

5.        https://www.darktrace.com/blog/hola-vpn-abuse-from-proxy-traffic-to-malware-and-cryptomining

6.        https://www.darktrace.com/blog/security-after-signatures-operating-in-a-world-of-pre-cve-disclosure-exploitation-collapsed-trust-boundaries-and-autonomous-systems

7.        https://www.darktrace.com/blog/when-ai-infrastructure-becomes-part-of-the-attack-surface

8.        https://www.darktrace.com/blog/cve-2026-1731-how-darktrace-sees-the-beyondtrust-exploitation-wave-unfolding

9.        https://www.darktrace.com/resource/understanding-chinese-nexus-cyber-tradecraft

10.   https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor

11.  https://www.darktrace.com/blog/inside-zionsiphon-darktraces-analysis-of-ot-malware-targeting-israeli-water-systems

12.  https://www.darktrace.com/resources/the-state-of-cybersecurity-in-the-finance-sector

13.  https://www.darktrace.com/blog/from-click-to-command-behavioral-detection-of-applescript-led-macos-intrusions

14.  https://www.darktrace.com/blog/the-state-of-cybersecurity-in-the-finance-sector-six-trends-to-watch

Mission-Critical Marine Services

This marine organization supports offshore energy production, export infrastructure, and regional logistics, delivering critical services through its diverse fleet and a regional shorebase footprint. To power rapid mobilization and 24/7 operational readiness, the organization has embraced cloud adoption and digital transformation, reshaping how crews, contractors, and shore-based teams access services.

While technology modernization has enhanced operations, it has also introduced new security complexities.

• From perimeter to identity: As access becomes more distributed, identity has become the primary security control, elevating the risk of credential compromise and privilege misuse.
• From confidentiality to availability and resilience: As cloud platforms increasingly underpin fleet and operational systems, cyber incidents can disrupt services and safety.
• From isolated tools to unified visibility:  Because Information Technology (IT) and Operational Technology (OT) often intersect, and legacy systems coexist with modern cloud platforms, fragmented monitoring makes it harder to understand risk and respond decisively across domains.

“Our cybersecurity priorities expanded along with our business goals, placing availability and resilience at the forefront. The impact of a potential threat became an operational risk, which elevated cybersecurity from an IT issue to an operational safety and resilience enabler.” - Information and Communications Technology (ICT) Manager.

A Unified, AI-Driven Platform for IT and OT

To strengthen visibility, detection, and response across its highly distributed environment, the customer adopted the Darktrace ActiveAI Security Platform™ in 2022.

Darktrace’s contextual detection capability was a key driver. Unlike traditional tools that rely on known threat signatures, Darktrace’s Self-Learning AI learns “normal” behavior to identify emerging threats and correlate visibility across the customer's siloed on-premises and cloud domains.

Today, the customer relies on:

• Darktrace / EMAIL™ to reduce phishing risk and minimize disruption from legacy mail controls and false positives
• Darktrace / IDENTITY™ to support identity-centric security as cloud access expands across vessels and shore-based operations
• Darktrace / NETWORK™ to strengthen oversight across the broader environment, including operational contexts where IT and OT intersect
• Darktrace / CLOUD™ (Azure), added in 2024, to extend detection and response into Azure and support cloud transformation without treating cloud as a separate security silo
• Darktrace / Incident Readiness & Recovery to strengthen incident readiness and recovery planning
• Darktrace Managed Detection and Response Services to provide 24/7/365 monitoring and support

This combination supports a single operating model for the customer: security that can adapt as the environment changes while remaining practical for a lean team responsible for safeguarding both business operations and safety-critical services.

Extending cloud protection without complexity

As the customer accelerated cloud adoption, it expanded coverage in 2024 with Darktrace / CLOUD for Azure to bring cloud workloads under the same AI-driven visibility and response model – without adding operational burden. “This matters in hybrid environments because attacks rarely stay in one place,” explains the ICT Manager. “A compromised identity can trigger activity in the cloud, which can open pathways back into on-premises systems.”

In parallel, Darktrace / CLOUD’s posture management capabilities support governance and audit readiness by surfacing misconfigurations and exposure risks earlier, before they become incidents.

A Stronger, Faster, More Resilient Business

Since adopting Darktrace, the customer has strengthened cyber resilience while reducing operational burden on its small ICT team.

Darktrace continuously analyzes millions of individual events that can contribute to a wider incident. Within a single month, the solution autonomously investigated 88% of all potential threats, taking appropriate action within just 39.4 seconds on average.

Autonomous capabilities ensure threats are stopped and contained until the ICT team can investigate. In one standout instance, Darktrace autonomously blocked malicious links during a mass phishing/spam event before other controls flagged the threat. the ICT Manager later confirmed Microsoft reported the link as malicious, but Darktrace had already acted to prevent delivery and reduce exposure.

“Whether something happens during off hours, while we’re on vacation, or when our attention is focused elsewhere, we’re confident Darktrace will take control and stop a threat before it spreads,” says the ICT Manager.

Darktrace’s Self-Learning AI combines multiple AI methods and advanced techniques to improve threat detection, investigation, and response dramatically reducing alert overload and manual triage. Within a single month, the solution saved the customer's IT group 411 equivalent human investigation hours.

“For a lean team supporting a 24/7 operational footprint, this autonomous action eliminates the constant firefighting and stress, giving us the space to focus on higher-value priorities.”- Information and Communications Technology (ICT) Manager.

Protecting communications without disruption

the customer experienced friction from legacy email and network controls prior to Darktrace, which generated high false positive rates, disrupted legitimate communications, created operational drag, and added workload for ICT. With Darktrace / EMAIL learning normal email behavior and applying context-aware actions, the team reduced unnecessary interruptions while maintaining protection.

“That shift matters in marine services, where business communications directly support coordination across vessels, shore bases, clients, ports, and regulators,” says the ICT Manager. “Darktrace doesn’t just block more threats, it autonomously makes decisions that preserve operational continuity and enable my team to focus on credible threats instead of chasing volume.”

Delivering clarity and confidence

Darktrace has reduced manual triage by correlating activity across email, identity, network, and cloud, providing the context needed to prioritize what matters without requiring the ICT team to stitch together evidence across multiple tools.

“With unified visibility we can identify patterns across domains, make informed decisions about where risk actually exists, and align security actions with operational impact rather than theoretical threats,” explains the ICT Manager. “I can now prioritize effort and investment across our ICT landscape with far greater confidence.”

Regular Executive Threat Reports reinforce operational confidence by giving leadership clear visibility into threats Darktrace has handled autonomously, supporting decisive action when needed and confidence to avoid unnecessary disruption when it isn’t.

Scaling Securely in a Hybrid World

As the customer advances its cloud transformation, the ICT Manager sees the Darktrace partnership evolving into a foundational layer of resilience and assurance, supporting scale, governance, and operational confidence in an increasingly cloud-centric environment.

Key priorities include:

• Shifting from hybrid visibility to cloud-first resilience, using continuous monitoring and posture insights to reduce exposure earlier
• Strengthening governance and audit readiness, especially as critical workloads and sensitive data expand in Azure and expectations rise under regulatory and client assurance requirements
• Increasing reliance on autonomous response and AI investigation as the number of identities, workloads, and access paths grows faster than headcount
• Deepening cross-domain correlation so cloud signals further enrich decision-making, supporting faster containment and more confident prioritization

“As we accelerate our cloud strategy, Darktrace will play an even more strategic role,” says the ICT Manager, “providing the guidance, technology, and expertise that allow us to grow with confidence and innovate securely.”

‍