Report by Fortinet
2026 Global Threat Landscape Report
Key Findings
Time-to-exploit (TTE) is 24–48 hours for critical outbreaks, compared to 4.76 days previously.
Credential-stealer infections were dominated by RedLine with 911,968 infections (50.80%), Lumma with 499,784 infections (27.84%), and Vidar with 236,778 infections (13.19%).
The top three targeted sectors by ransomware victims were manufacturing (1,284), business services (824), and retail (682).
Brute force attempts decreased 22% year-over-year.
There were 7,831 confirmed ransomware victims globally, a 389% year-over-year increase from approximately 1,600 victims previously.
Within dark web "database" activity, stealer logs comprised 67.12% of advertised/shared datasets, combolists 16.47%, and leaked credentials 5.96%.
Ransomware victims concentrate geographically with the U.S. at 3,381, Canada at 374, and Germany at 291.
Global exploitation attempts increased 25.49% year-over-year.