CrowdStrike

China-nexus adversaries drove more than 58% of state-sponsored targeted intrusions against the technology sector.

The Axios NPM package was downloaded 100 million times per week.

Malware operators compromised 350 GitHub repositories to inject malicious code into JavaScript and Python projects.

Vishing intrusions increased by 2x in 1H 2026.

SNARKY SPIDER moved from account takeover to data theft in under five minutes in one incident.

China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept release.

MURKY PANDA deployed an operational relay box network across more than 150 endpoints in 36 countries, targeting 340 organizations across more than 30 sectors.

423 financial services organizations appeared on dedicated leak sites, marking a 27% year-over-year increase.

PRESSURE CHOLLIMA conducted the largest financial theft ever reported: $1.46 billion in cryptocurrency via a trojanized supply chain compromise.

DPRK-linked incidents rose by more than 130%.

PRESSURE CHOLLIMA stole $1.46 billion in cryptocurrency, the largest single financial heist ever reported.

Average eCrime breakout time fell to 29 minutes in 2025.

260 initial access brokers advertised to over 1,400 European organizations in 2025

Ransomware deployment speed increased by 48% as observed in 2025

Since January 1, 2024, more than 2,100 victims across Europe were named on extortion leak sites

Over 40% of organizations reported using AI or automation to support threat detection and alerting in response to a ransomware incident

37% of financial services organizations suffered significant disruption to business operations due to ransomware attacks.

87% of organizations expect deepfakes to become major attack vectors in future ransomware campaigns.

eCrime activity represented 73% of total interactive intrusions.

FAMOUS CHOLLIMA infiltrated over 320 companies in the last 12 months, representing a 220% year-over-year increase.

Nation-state activity in the telecom sector rose by 130%, driven by adversaries like GLACIAL PANDA.

Among SMBs under 25 employees who experienced a cyber incident in the past year, 29% reported ransomware.

50% of SMBs feel overwhelmed by the number of cybersecurity tools on the market.

Nearly 70% of SMBs rely on third-party guidance to inform buying decisions.

The average eCrime breakout time dropped to 48 minutes, with the fastest recorded at 51 seconds.

China's cyber espionage attacks increased by 150%, with targeted attacks in financial services, media, manufacturing, and industrial sectors soaring up to 300%.

Voice phishing (vishing) increased by 442% between H1 and H2 2024 due to AI-driven phishing and impersonation tactics.

Initial access brokers advertised access to 277 technology organizations, a nearly 30% increase.

MURKY PANDA's password-spraying campaign impacted more than 340 U.S.-based entities.

FAMOUS CHOLLIMA accounted for 47% of all state-sponsored interactive intrusions against the technology sector.

Big game hunting adversaries named 572 technology entities on dedicated leak sites for extortion.

Financially motivated attacks accounted for 65% of all interactive operations against the technology sector.

DPRK-nexus adversaries injected malicious packages into AI frameworks, poisoning 131 trusted AI framework packages.

One campaign sent nearly 200,000 AI model requests in two minutes.

AI agent-triggered detection leads grew at 2.5x the rate of human-triggered leads.

In 1H 2026, 87% of identified software registry threats involved malicious npm packages.

eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Monthly device code phishing attempts increased 15x in 1H 2026.

Cloud-conscious eCrime activity surged 171% as adversaries executed credential theft, cryptomining, LLM abuse, and digital financial asset theft.

In 1H 2026, 88% of observed exploitation of vulnerabilities with a public PoC occured within 48 hours of release.

China-nexus actors VAULT PANDA and GENESIS PANDA launched deliberate attacks within 24 hours of disclosure.

Hands-on-keyboard intrusions against financial institutions spiked 43% globally and 48% in North America over the past two years.

DPRK-nexus actors stole a reported $2.02 billion in digital assets across the financial services sector in 2025.

SCATTERED SPIDER resumed aggressive ransomware operations against insurance entities in the first half of 2025 after a four-month pause.

FAMOUS CHOLLIMA doubled its operations using AI-generated identities to infiltrate cryptocurrency exchanges, fintech platforms, and consumer banks.

DPRK-nexus actors drove a 51% year-over-year increase in digital asset theft in 2025.

STARDUST CHOLLIMA tripled its operational tempo and deployed AI-generated recruiter personas and synthetic video conferencing environments to target fintechs across North America, Europe, and Asia.

The fastest observed eCrime breakout occured in 27 seconds.

42% of vulnerabilities were exploited before public disclosure.

Average eCrime breakout time of 29 minutes was 65% faster than in 2024.