News

While ransomware and encryption once dominated headlines as the clearest signs of cyber risk, a quieter transformation is reshaping the threat landscape. Picus Labs’ 2026 Red Report, which examined over 1.1 million malicious files and 15.5 million adversarial actions in 2025, reveals that attackers are no longer focused on causing immediate chaos. Instead, their objectives now center on establishing persistent, undetectable access to systems-a strategy that prioritizes subtlety over disruption.

The data underscores a strategic pivot: what was once defined by loud, destructive attacks is increasingly replaced by methods that blend into the background. Threat actors are adopting the role of “digital parasites,” embedding themselves within networks, feeding on stolen credentials and services while remaining invisible for extended periods. This shift reflects a broader trend where the goal is not to cripple systems but to maintain control undetected, leveraging trusted infrastructure to maximize dwell time.

Public perception often fixates on high-impact incidents like outages or data breaches. However, the 2025 report tells a different story-one where defenders are losing ground not through visible failures but through gaps in visibility against sophisticated, low-key tactics. The ransomware signal, which once served as an undeniable marker of compromise, is fading as attackers abandon encryption in favor of alternative monetization strategies.

For years, the lockout of systems via encryption was a definitive indicator of an attack. This signal, however, has diminished by nearly 40% year-over-year, dropping from 21% in 2024 to just 13% in 2025. This decline isn’t due to reduced attacker capability but a calculated shift toward data extortion. By avoiding encryption, adversaries keep operations running while quietly exfiltrating sensitive information, harvesting login credentials, and embedding themselves deeply within environments. Their pressure tactics come later, through extortion rather than disruption.

The core implication is that impact is no longer measured by locked systems but by how long attackers can remain undetected within a network. As Picus Labs notes, “The adversary’s business model has shifted from immediate disruption to long-lived access,” highlighting a fundamental change in how threats are executed and sustained.

Credential theft has emerged as a critical control mechanism in this new paradigm. The report reveals that stolen credentials from password managers, browser caches, and system keychains appear in nearly a quarter of all observed attacks. Unlike older methods reliant on noisy credential dumping, modern attackers extract saved login details directly, enabling rapid privilege escalation and lateral movement with minimal noise. This approach transforms identity into the primary pathway for maintaining control, bypassing traditional detection mechanisms.

Malware campaigns are increasingly behaving like silent infiltrators. Unlike earlier threats that triggered alarms or forced system crashes, today’s attacks operate with eerie quiet. They rely on techniques that mimic legitimate activity, using trusted processes and communication channels to evade detection. This evolution mirrors a broader trend where stealth is prioritized over visibility, making traditional signature-based defenses less effective.

The MITRE ATT&CK framework highlights this shift in attacker behavior. Eight of the top ten techniques now focus on evasion, persistence, or stealthy command-and-control. Picus Labs reports the highest concentration of stealth-focused tactics ever observed, signaling that success in modern attacks hinges on remaining undetected rather than causing immediate harm. Techniques like process injection, boot autostart execution, and application-layer protocol abuse allow malware to blend into normal traffic, exploiting trusted tools to achieve their goals.

Modern malware is also becoming self-aware in its evasion tactics. The rise of virtualization and sandbox evasion (T1497) in 2025 shows attackers adapting to avoid analysis tools. Some samples now assess their execution environment-monitoring mouse movements, evaluating user interaction patterns-to determine if they’re in a real system or an automated sandbox. For example, LummaC2 malware uses geometric calculations to detect artificial cursor behavior, suppressing activity until it reaches a genuine target. This behavior underscores a new reality: inaction itself is a form of evasion.

The role of artificial intelligence in this landscape remains overhyped. Despite expectations, Picus Labs found no significant increase in AI-driven malware techniques in 2025. Traditional methods like process injection and script-based command execution continue to dominate. While some malware families experiment with large language models for communication, these efforts remain limited in scope, enhancing efficiency without fundamentally altering attacker strategies. The “digital parasite” model persists: credential theft, stealthy persistence, and prolonged dwell times remain the core tactics.

This shift demands a reevaluation of defensive strategies. Organizations must prioritize behavior-based detection, robust credential management, and continuous adversarial testing to counter threats that operate quietly. The focus should move away from preparing for dramatic attacks and toward mitigating the silent, persistent risks that are already succeeding.

For those seeking to understand this new threat model, Picus Security’s 2026 Red Report offers critical insights. It details how attackers are staying inside networks longer than ever, leveraging trusted identities and tools to avoid detection. While ransomware headlines may dominate media, the real risk lies in the quiet, sustained compromise that goes unnoticed until it’s too late.

Ready to validate your defenses against these stealth-driven threats? Download the Picus Red Report 2026 to explore the data behind the “digital parasite” model and understand how modern adversaries are reshaping cybersecurity.