Threat Research

The CyOps Examination of Cyber Hostility and Operations Report: 1H 2026

Six months of frontline incident response. See the tactics, strategy, and behavior that defined the first half of 2026, and where CyOps expects them to go next.

Across the first half of 2026, attackers kept moving away from exploited code and toward abused identity, abused gateways, and abused trust. Malicious actors moved at machine speed while defenders scrambled to keep up, as the very tools they trusted to keep them safe turned into effective weapons. Cynet's Examination of Cyber Hostility and Operations (ECHO) walks through what that looked like on the ground: the numbers behind it, the case studies that show the playbook end to end, and the recommendations we'd put in front of any team hardening against it.

Get the Report

8 in 10

host breaches in the CyOps docket began with stolen identity, not an exploited vulnerability

27 %

of host breaches entered through an SSL-VPN gateway — driven by stolen credentials, not appliance CVEs

304

incidents handled by CyOps analysts from January 1 through June 30, 2026

Key Findings

Identity is still the front door.

Stolen credentials, infostealer-sourced access, and socially engineered sessions drove the dominant access pattern of the period. Microsoft Teams vishing crossed from outlier to signature move, and once inside the identity layer, attackers used automation clients and hidden inbox rules to operationalize access and pivot to fraud — often without dropping malware on a single endpoint.
The edge is still the easiest way in.

SSL-VPN gateways remained a top intrusion path, and every Akira-aligned host breach CyOps root-caused entered through the same class of device. The story wasn't zero-days; it was stolen passwords reused against the gateway and MFA-reset paths that let a known password stand in for a second factor.

Trusted tools became weapons.

Attackers increasingly aren't writing the malware. They're renting the remote-support tools IT already trusts — ScreenConnect, AnyDesk, Quick Assist, Bomgar — driving them through PowerShell and signed Windows binaries, and loading someone else's signed-but-vulnerable driver to blind the security stack before deploying ransomware.
AI is compressing the defender's window in real time.

Voice cloning good enough to fool a help desk, RaaS panels stood up in days with AI coding assistants, credential-harvesting operations enriched at machine speed — none of it required a novel exploit. The gap between how fast attackers can move and how fast most organizations can respond is widening, and AI is the reason.

Methodology

The CyOps ECHO Report is built from CyOps-handled incidents spanning January 1 through June 30, 2026 — 304 engagements across identity cases, host breaches, and other events meeting CyOps intake criteria. Internal findings are drawn directly from CyOps incident records and reported separately from external intelligence. Ransomware ecosystem figures reflect RansomLook-tracked public leak-site postings over the same window, and external CTI, CVE references, and market commentary are labeled as open-source throughout. Every case is anonymized to sector and region; no customer names, files, credentials, or private communications are published.

Why We're Sharing This Research

The shape of the 1H 2026 docket is the same story told three ways: identity, the edge, and trusted tooling are all versions of one failure — security controls working exactly as designed, in the wrong hands. This report benchmarks how those attacks actually unfold, maps each technique class to MITRE ATT&CK, and closes with role-based, tiered recommendations for CISOs, SOC, IAM, Infra/Edge, and IR teams — so you can see precisely where to harden first.