CrowdStrike 2026 Report: AI Cyberattacks Explode as Hackers Exploit Vulnerabilities in 24 Hours

AI is both a cyber weapon and a massive target, CrowdStrike warns

Follow ZDNET: Add us as a preferred source on Google. ZDNET's key takeaways * CrowdStrike warns AI is both a target and a weapon. * LLMJacking made nearly 200,000 API calls in two minutes. * Malicious AI exploits flaws faster than defenders can patch them. Artificial intelligence is increasingly "an adversary tool and target," researchers said, forcing businesses to rethink their defensive strategies in light of attack signals far outstripping what cybersecurity experts can manually handle. According to CrowdStrike's 2026 Threat Hunting Report, published on Monday, the same AI models, tools, and workflows that are giving businesses growth and productivity opportunities are being weaponized by cybercriminals in droves. Also: How Google used AI agents to find and fix 1,072 Chrome security bugs - in 60 days As corporate networks expand, endpoint devices are added, and new large language models (LLMs) are deployed to handle various workloads, organizations are also unwittingly creating larger "undefended" attack surfaces that can be exploited to steal data, obtain AI model access, conduct surveillance, and potentially even harvest computing power for their own ends. AI: The new weapon and target "AI is not just the tool or weapon that is being used, but it is also the attack surface," Adam Meyers, head of threat intel at CrowdStrike, commented. "We're seeing threat actors really adopt AI at the same speed that everybody else is." CrowdStrike's report said that the widespread adoption of artificial intelligence (much of it new and unproven) is increasing the sheer volume of signals that defenders have to sort through. Also: Assume AI cybersecurity attacks are the future: 43% of companies have already experienced it There are now 2.5 times as many AI agent-triggered leads for the firm's threat hunters to examine as there are manually driven leads, which CrowdStrike said "makes it more difficult for defenders to distinguish malicious activity from expected AI-driven behavior." Suspicious alerts and signals underscore AI-driven activity in the criminal world -- and the rapid speeds at which attacks are now being conducted. CrowdStrike gave a number of examples, including: * Famous Chollima: A Democratic People's Republic of Korea (DPRK)-associated group is actively weaponizing trusted AI environments and tools to try to gain entry to companies working in cryptocurrency and the blockchain, using everything from AI-generated resumes to deepfake interviews. * Cordial Spider, Snarky Spider: These groups use vishing to exfiltrate data from SaaS apps and compromise single sign-on accounts. In one case documented by the researchers, an attack shifted from account takeover to data theft in less than five minutes. * LLMJacking: LLMJacking occurs when a threat actor gains access to keys or credentials used to access a company's AI models. Armed with access to these LLMs -- which are typically cloud-based -- threat actors can then steal data and wreak havoc, such as forcing the model to perform malicious tasks or those that demand high compute power, creating massive bills for the victim. For example, CrowdStrike said that in one campaign, the victim's LLM was used to generate close to 200,000 API requests in two minutes, "resulting in large-scale financial and operational impact." AI is mostly used by cybercriminals today to generate phishing and vishing material, payloads, and commands, streamlining their attack chains and potentially creating more convincing phishing schemes designed for initial access. Meyers said these creations are becoming more bespoke, with custom tools generated by AI and LLMs to manage different defense scenarios. Vulnerability windows vanish: More bad news for defenders Another concerning trend highlighted in the report is the shrinking window that human defenders -- and their tools -- have to respond between vulnerability discovery and exploitation. From January through June 2026, 88% of exploits detected by CrowdStrike were launched within 48 hours of a public proof-of-concept (PoC) code release. Also: Not just OpenAI - Anthropic says Claude's hacking spree 'falls short of ideal behavior' Some threat groups, such as China's Vault Panda and Genesis Panda, are keeping an even closer eye on new bugs: They developed working exploits for a critical vulnerability in a web application (React2Shell) within a day of disclosure. In these situations, AI goes both ways. Two out of three recently disclosed LPE exploits, CopyFail and Fragnesia (Dirty Frag being the third), were discovered by AI-assisted research, and the report said "threat actors wasted no time incorporating them into active operations." What does this mean for the enterprise and its cybersecurity teams? According to CrowdStrike, response times are going to become shorter and shorter -- no doubt due in part to the weaponization of AI. Also: Claude AI shared chats indexed by Google - see if your conversations were exposed "While this pattern predates the emergence of frontier AI models, the implementation of these systems is likely to compress vulnerability exploitation timelines by accelerating vulnerability discovery and exploit development," the researchers said. "This could, in turn, increase the pressure on defenders already struggling to keep pace." Your move AI can act as a shield, but as CrowdStrike's research revealed, it can also be a weapon. Also: Open weights vs. closed: An AI civil war's afoot, and the stakes are existential With the pressure caused by AI, defenders will be hard-pressed to retain control and secure the networks and endpoints they are responsible for, and so the team recommended that businesses adopt the following practices:

AI is 'both the weapon and the target' in latest wave of cyberattacks

AI is becoming both an attack tool and a high-value target, with attacks by AI-enabled adversaries rising 89 percent in 2025, according to CrowdStrike. The security firm's annual Threat Hunting Report details criminal gangs and nation states using AI throughout the attack chain. Attackers are also targeting organizations' AI infrastructure and poisoning popular software packages to compromise their users. "AI is both the weapon and the target," CrowdStrike counter adversary division senior VP Adam Meyers told reporters. "AI is a high-value attack surface, and it's being used by more and more threat actors." These attacks include LLMjacking, in which criminals steal corporate credentials to access frontier-model APIs, and cost harvesting - deliberately inflating a victim's AI usage to run up its bill. In one campaign, CrowdStrike documented a token thief sending about 200,000 API requests in just two minutes. The security vendor's threat hunting team now tracks AI agent-triggered leads at 2.5x the rate of human-triggered threats, and Meyers said this increased volume remains true across both government-backed goons and financially motivated criminals. CrowdStrike tracks more than 290 adversary groups, having added about ten this year. Of the 290, a North Korean crew it tracks as Famous Chollima - a sub-unit operating under the Lazarus Group umbrella and best known for its fake IT worker scams - "demonstrated the most advanced AI usage" over the second half of 2025 and first half of 2026, according to the report. This government-backed crew created "entire fake companies with AI-generated websites, GitHub accounts, and email infrastructure to support insider threat operations," the authors wrote. AI supply-chain compromise was the second most common MITRE ATLAS technique used by attackers to gain initial access, and Famous Chollima's campaign targeting AI-focused development environments "was one of the most sophisticated examples of this technique in practice," the report noted. This included a supply-chain attack in January and February targeting cryptocurrency and blockchain companies. In these attacks, the Norks published trojanized repositories, primarily hosted on GitHub, that contained legitimate-looking project files alongside hidden, malicious scripts. When developers opened these repos, malicious scripts automatically executed commands that gave Famous Chollima access to their environments. "AIs themselves are being targeted through that supply chain and through the CI/CD pipelines that they're dependent on," Meyers said. Threat hunters suspect another Lazarus Group offshoot, tracked as Stardust Chollima or Sapphire Sleet, was behind the March Axios supply chain attack. Last week, Amazon attributed four npm compromises over the past 18 months to the same North Korean crew. Meanwhile, a financially motivated crew tracked by CrowdStrike as Altered Spider and elsewhere as TeamPCP targeted developers' AI tools, compromising more than 300 software dependencies in one day. It harvested credentials and secrets before pivoting into cloud environments for theft and extortion. Altered Spider "hits the endpoint in seconds and within minutes, they're inside of the cloud," Meyers said. "It gives you a sense of how quickly they can move throughout that environment, and this is all tied again to software supply chains." Patching window slams shut CrowdStrike argues that AI is helping attackers exploit newly disclosed vulnerabilities at machine speed. From January to June, 88 percent of the exploitation observed by CrowdStrike using public proof-of-concept (PoC) code occurred within 48 hours of the code's release. The company said China-linked groups such as Vault Panda and Genesis Panda moved even faster, launching attacks within 24 hours of disclosure. "Vulnerabilities are weaponized through the use of AI," Meyers said. "This is creating a rich ecosystem of vulnerabilities for attackers to use against various systems, and what this really means is that the 30-day patch window, which frankly, was aspirational, is completely obsolete. We're down to 24-hour, 48-hour patch cycles, and organizations are really struggling under that." Meanwhile, as anyone who follows Microsoft's Patch Tuesday - or any other software vendors' vulnerability disclosures over the past few months - knows, AI is also really good at finding bugs in code. This means more CVEs and more patching for sysadmins racing to fix flaws before miscreants reverse-engineer the updates and develop exploits. "In 2025, there were something like 48,200 CVEs that were registered," Meyers said. "We're already, as of last week, at 43,000 for this year. We're not even into August yet, and we're already coming very close to the number from last year." June alone saw more than 7,600 software bugs reported and tracked through CVEs, he added. "The vulnerability ecosystem is going to be the big story for the next couple of months." ®

CrowdStrike finds AI systems under direct attack as exploit windows shrink

Artificial intelligence has become a target for attackers rather than only a tool they use, according to CrowdStrike Holdings Inc.'s "2026 Threat Hunting Report," released today. The annual report draws on observations from CrowdStrike's OverWatch threat hunting team and intelligence analysts tracking more than 290 named adversaries over the 12 months to June 30. Previous editions counted only interactive, hands-on-keyboard intrusions. This year's also folds in automated attacks, a methodology change CrowdStrike says gives a more accurate picture of how adversaries now operate. CrowdStrike now measures the exploitation window in hours rather than days. It counted the gap between a proof-of-concept exploit going public and attackers picking it up. Between January and June, that gap came in under 48 hours in 88% of cases, and the year before, zero-day exploitation had risen 42%. Two China-nexus groups beat even that. React2Shell (CVE-2025-55182), an unauthenticated remote code execution flaw in React Server Components and Next.js, was disclosed alongside patches on Dec. 3, 2025. Working exploit code appeared the next day. Vault Panda and Genesis Panda were attacking within 24 hours. OverWatch chased more than 800 hunting leads at more than 80 victims in the first four days. AI infrastructure itself is now being probed directly. AI model access techniques accounted for 16% of the MITRE ATLAS techniques CrowdStrike observed over the year. The company's honeypot infrastructure captured one exploit payload carrying a malicious Model Context Protocol server configuration, built to read a parent process's environment variables and send configuration data to an external webhook. Corporate large language model access is being hijacked outright, a practice the report calls LLMjacking. In a May campaign against a cloud provider's foundation model service, a threat actor escalated a compromised identity to administrator privileges and submitted the use-case form required to unlock model access. It then sent nearly 200,000 application programming interface requests in an initial two-minute flood before throttling kicked in. Adversaries are using the technology as much as they are attacking it. Famous Chollima, the North Korean group behind large-scale IT worker infiltration, built entire fake companies with AI-generated websites, GitHub accounts and email infrastructure to support insider operations. AI agent-triggered detection leads now arrive at 2.5 times the rate of human-triggered leads, OverWatch said. Software registries remain the shortest path into developer environments. Malicious npm packages accounted for 87% of identified malicious software registry threats in the first half of 2026. Stardust Chollima used stolen maintainer credentials to compromise the Axios npm package in March. In June it injected a malicious npm dependency into at least 131 Mastra AI framework packages. The way in was a Mastra employee: the group approached them on LinkedIn, then got them onto a video call and talked them into clicking a malicious link. Internet crime group Altered Spider works at a different scale. Its malware self-propagates, taking stolen maintainer credentials and republishing infected packages on its own. In one day during its May campaigns, the group compromised more than 300 software dependencies. In March, it poisoned Git tags on the publicly available trivy-action GitHub Action, part of Aqua Security Software Ltd.'s Trivy scanner, so that any organization pulling the affected releases in an automated build ran credential-stealing malware inside its own pipeline. Researchers at Forcepoint LLC detailed that compromise in May and traced it to a group they called TeamPCP. CrowdStrike attributes the activity to Altered Spider. Identity abuse rounds out the picture. Vishing intrusions in the first half of 2026 ran at twice the rate of the second half of 2025, following a 134% increase between 2024 and 2025. Cordial Spider and Snarky Spider used vishing calls to steer targets to spoofed single sign-on pages loaded on personal mobile devices, then moved into integrated software-as-a-service applications to exfiltrate data. In one incident, Snarky Spider went from account takeover to data theft in under five minutes. Monthly device code phishing attempts rose 15-fold over the past six months. Cloud-conscious internet crime activity climbed 171% over the reporting period. In one case a threat actor hijacked cloud resources at a U.S. technology company across three parallel attack vectors, mining about $41,000 worth of Monero while altering instance settings to stop the victim reclaiming the compute. Not every intrusion arrived over a network. Between March and May, OverWatch disrupted close access operations in which China-nexus adversary Overcast Panda installed its FlowCloud backdoor on unattended laptops belonging to travelers inside China. The adversary booted the machines from removable media, writing the implant to disk outside the running operating system. Overall intrusion activity rose roughly 4%, well down on the 27% surge reported a year ago, though this year's count includes automated attacks that earlier editions excluded. CrowdStrike attributed the plateau to adversaries putting time into fewer, more complex campaigns. Technology was the most targeted sector for the ninth consecutive year, while financial services and academic institutions recorded the largest increases, at 11% and 17%. "AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend," said Adam Meyers, head of counter adversary operations at CrowdStrike, in announcing the report. "The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary."

CrowdStrike 2026 Report Reveals AI-Driven Cyber Threat Surge

CrowdStrike Threat Hunting Report Highlights: Based on frontline intelligence from CrowdStrike's elite threat hunters and intelligence analysts tracking more than 290 named adversaries, the report reveals: AI Is a Tool, Target, and Force Multiplier for Adversaries: Threat actors used AI to generate payloads and shell commands, exploit AI infrastructure, and abuse enterprise LLMs - including one campaign that sent nearly 200,000 AI model requests in two minutes. CrowdStrike OverWatch also observed AI agent-triggered detection leads grew at 2.5x the rate of human-triggered leads, showing how AI is accelerating the volume and velocity of activity security teams must investigate. The AI Ecosystem Is the Next Supply Chain Battleground: DPRK-nexus STARDUST CHOLLIMA injected a malicious npm package into 131 trusted Mastra AI frameworks. During 1H 2026, 87% of identified software registry threats involved malicious npm packages. eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments. Exploitation Windows Collapse to Hours: In 1H 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a PoC occurred within 48 hours of release. China-nexus actors VAULT PANDA and GENESIS PANDA moved even faster, launching deliberate attacks within 24 hours of disclosure. Adversaries Follow AI into the Cloud: Cloud-conscious eCrime activity surged 171% as adversaries executed credential theft, cryptomining, LLM abuse, and digital financial asset theft. Trusted Authentication Becomes an Attack Path: Vishing intrusions increased by 2x in 1H 2026. eCrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on (SSO) integrated SaaS applications for data exfiltration. In one incident, SNARKY SPIDER moved from account takeover to data theft in under five minutes. Monthly device code phishing attempts increased 15x in 1H 2026, reflecting growing abuse of trusted authentication workflows.

CrowdStrike 2026 Report: AI Is Now Fully Embedded in Cyberattacks

Threat actors operationalize AI to exploit vulnerabilities within hours, target enterprise AI, and scale attacks across software supply chains CrowdStrike today released the 2026 Threat Hunting Report, revealing that AI is now embedded across modern adversary operations. China-nexus adversaries exploited critical vulnerabilities within 24 hours of public proof-of-concept (PoC) release, while DPRK-nexus adversaries poisoned 131 trusted AI framework packages, demonstrating how AI has become both an operational capability and a high-value target. AI is now a tool, target, and force multiplier for adversaries. As enterprises embed AI across their business, adversaries are exploiting AI infrastructure, compromising software supply chains, abusing enterprise LLMs, and following AI workloads into the cloud. The result is a new operational reality: attacks move faster, scale more efficiently, and increasingly target the AI systems enterprises depend on. CrowdStrike Threat Hunting Report Highlights: Based on frontline intelligence from CrowdStrike's elite threat hunters and intelligence analysts tracking more than 290 named adversaries, the report reveals: * AI Is a Tool, Target, and Force Multiplier for Adversaries: Threat actors used AI to generate payloads and shell commands, exploit AI infrastructure, and abuse enterprise LLMs - including one campaign that sent nearly 200,000 AI model requests in two minutes. CrowdStrike OverWatch also observed AI agent-triggered detection leads grew at 2.5x the rate of human-triggered leads, showing how AI is accelerating the volume and velocity of activity security teams must investigate. * The AI Ecosystem Is the Next Supply Chain Battleground: DPRK-nexus STARDUST CHOLLIMA injected a malicious npm package into 131 trusted Mastra AI frameworks. During 1H 2026, 87% of identified software registry threats involved malicious npm packages. eCrime actor ALTERED SPIDER compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments. * Exploitation Windows Collapse to Hours: In 1H 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a PoC occurred within 48 hours of release. China-nexus actors VAULT PANDA and GENESIS PANDA moved even faster, launching deliberate attacks within 24 hours of disclosure. * Adversaries Follow AI into the Cloud: Cloud-conscious eCrime activity surged 171% as adversaries executed credential theft, cryptomining, LLM abuse, and digital financial asset theft. * Trusted Authentication Becomes an Attack Path: Vishing intrusions increased by 2x in 1H 2026. eCrime groups CORDIAL SPIDER and SNARKY SPIDER compromised single sign-on (SSO) integrated SaaS applications for data exfiltration. In one incident, SNARKY SPIDER moved from account takeover to data theft in under five minutes. Monthly device code phishing attempts increased 15x in 1H 2026, reflecting growing abuse of trusted authentication workflows. "AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend," said Adam Meyers, head of counter adversary operations at CrowdStrike. "The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary."

TrendAI Report Warns of Rising AI-Driven Cyber Threats to Financial Sector

Instead, they are actively disrupting defenders during live incidents, using artificial intelligence to increase the speed, scale and sophistication of attacks. Financial institutions are facing an unprecedented wave of AI-powered cyberattacks as cybercrime groups increasingly automate fraud, ransomware and intrusion campaigns, according to new research from TrendAI. The Modern Bank Heists in 2026 report, based on a survey of 46 Chief Information Security Officers (CISOs) from financial institutions worldwide, reveals that attackers are no longer simply stealing data. Instead, they are actively disrupting defenders during live incidents, using artificial intelligence to increase the speed, scale and sophistication of attacks. Among the report's key findings: The report also highlights how cybercrime groups are rapidly adopting agentic AI to automate phishing, fraud and exploitation at machine speed. Rather than relying on individual operators, attackers are increasingly orchestrating specialised AI agents capable of running multiple stages of an attack simultaneously. Sharda Tickoo, Country Manager, India & SAARC, TrendAI: "The most concerning finding isn't simply the rise in AI-enabled attacks. It's that attackers are actively disrupting defenders while incidents are unfolding. When adversaries can interfere with your response as well as execute the attack itself, the traditional rules of cyber defence no longer apply. Organisations need autonomous security capabilities that can fight back just as quickly." TrendAI researchers also identified growing use of advanced techniques including steganography, where malicious commands are hidden inside seemingly harmless images, allowing malware to evade traditional security controls. At the same time, commercially available Remote Access Trojans (RATs) continue to evolve, offering cybercriminals sophisticated capabilities once reserved for nation-state actors. The report concludes that financial institutions must shift from reactive cybersecurity to proactive intrusion suppression by combining AI-powered detection, threat intelligence, virtual patching, managed detection and response, and executive-level security leadership. Sharda added, "Trust has always been the foundation of banking. Today that trust is under sustained attack from cybercrime cartels using AI to scale operations faster than many organisations can defend themselves. Security leaders must be empowered to act independently, because defending financial institutions now requires continuous, intelligence-led operations rather than periodic response." Additional recommendations from TrendAI To counter increasingly autonomous attacks, TrendAI recommends financial institutions:

Cybercriminals Are Using AI to Outrun Financial Institutions, TrendAI Finds

Nearly nine in ten organisations report a surge in AI-enabled attacks as cybercrime cartels industrialise operations Financial institutions are facing an unprecedented wave of AI-powered cyberattacks as cybercrime groups increasingly automate fraud, ransomware and intrusion campaigns, according to new research from TrendAI. The Modern Bank Heists in 2026 report, based on a survey of 46 Chief Information Security Officers (CISOs) from financial institutions worldwide, reveals that attackers are no longer simply stealing data. Instead, they are actively disrupting defenders during live incidents, using artificial intelligence to increase the speed, scale and sophistication of attacks. Among the report's key findings: * 89%of organisations reported a year-on-year increase in AI-enabled attacks. * 67%experienced "counter incident response", where attackers actively interfered with security teams during live investigations. * 41%suffered destructive cyberattacks over the past year. * 55%reported an increase in API-based attacks. * 46%experienced attempts to steal non-public market intelligence or investment strategies. * More than half(54%)saw no increase in cybersecurity budgets despite the worsening threat landscape. The report also highlights how cybercrime groups are rapidly adopting agentic AI to automate phishing, fraud and exploitation at machine speed. Rather than relying on individual operators, attackers are increasingly orchestrating specialised AI agents capable of running multiple stages of an attack simultaneously. Sharda Tickoo, Country Manager, India & SAARC, TrendAI: "The most concerning finding isn't simply the rise in AI-enabled attacks. It's that attackers are actively disrupting defenders while incidents are unfolding. When adversaries can interfere with your response as well as execute the attack itself, the traditional rules of cyber defence no longer apply. Organisations need autonomous security capabilities that can fight back just as quickly." TrendAI researchers also identified growing use of advanced techniques including steganography, where malicious commands are hidden inside seemingly harmless images, allowing malware to evade traditional security controls. At the same time, commercially available Remote Access Trojans (RATs) continue to evolve, offering cybercriminals sophisticated capabilities once reserved for nation-state actors. The report concludes that financial institutions must shift from reactive cybersecurity to proactive intrusion suppression by combining AI-powered detection, threat intelligence, virtual patching, managed detection and response, and executive-level security leadership. Sharda added, "Trust has always been the foundation of banking. Today that trust is under sustained attack from cybercrime cartels using AI to scale operations faster than many organisations can defend themselves. Security leaders must be empowered to act independently, because defending financial institutions now requires continuous, intelligence-led operations rather than periodic response." Additional recommendations from TrendAI To counter increasingly autonomous attacks, TrendAI recommends financial institutions: * Adopt an intrusion suppression strategy that combines virtual patching, proactive threat hunting and managed detection and response. * Build AI-enabled security operations capable of responding at machine speed. * Strengthen protection against prompt injection, deepfake-enabled fraud and business email compromise.

TrendAI Report: Nation-State Actors Embed AI Across H1 2026 Attack Chains

Generative AI is now sharpening nation-state exploits and powering autonomous reconnaissance, mid-year findings show TrendAI today released its H1 2026 APT Activity Roundup. The mid-year findings on the H1 2026 threat landscape showed that AI has moved beyond isolated experiments. Nation states used AI in more stages of the intrusion lifecycle than any other prior half TrendAI has tracked. Between January and June 2026, TrendAI detected the following APT (advanced persistent threat) nation-state activity: * China-aligned threat actors used generative AI to sharpen exploits and iteratively build malware through vibe coding. One AI agent independently ran its own reconnaissance and lateral movement inside a target network. * Russia-aligned Pawn Storm opened the year with an Office zero-day vulnerability and kept pressing Ukraine and its partners across government, defense, and wartime-aid organizations. * DPRK-aligned actors folded commercial AI into their operations and poisoned a widely used software package to reach downstream developers. * Iran-aligned Earth Vetala scanned for a newly disclosed Ivanti vulnerability within days of its release, and other Iran-aligned actors carried out hands-on attacks against internet-exposed operational technology, tampering with fuel-tank gauges at sites in the United States. Sharda Tickoo, Country Manager for India and SAARC at TrendAI: "Artificial intelligence has stopped being a side tool for attackers and has become a teammate embedded in the operation itself. We are watching nation-state actors hand reconnaissance and lateral movement to an AI agent, and use generative models to iterate on malware the way a developer ships code. Defenders now have to assume the adversary on the other end of an intrusion may not be a person typing commands, but a system executing a plan." Key findings include: * AI now touches more stages of the intrusion lifecycle, from exploit development to autonomous reconnaissance and lateral movement * Known and zero-day vulnerabilities are weaponized within days of disclosure, and the software supply chain remains a favored entry point * Operational technology and physical-world targets -- including fuel-tank monitoring systems -- are back in attackers' crosshairs * A newer tracking method, ADINT, harvests location and device data from online ad auctions without deploying any malware * Threat actors increasingly hide command-and-control on trusted cloud platforms, developer tunnels, blockchains, and paste sites