Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Kasey Best, Director of Threat Intelligence, Silent Push
As we prepare for the arrival of 2026, we can look back on what happened in 2025 to forecast the types of threats the global community will encounter in the new year:
AI-Driven Attacks and AI-Supported Defenses will continue to get more attention as we try to keep up with evolving trends.
- Threat actors love AI website builders because they make it child’s play to create realistic-looking websites emulating their targets, at scale, in no time at all. We’re finding massive amounts of these sites being used to age domains before their use in malvertising attacks and other malicious campaigns. At this point, if you aren’t tracking AI website builders and the websites created from them, you’re missing out on the origination points of entire waves of attacks as many threat actors simply wait and send the next salvo’ once the first is done or has been blocked by defenders.
- Beyond those website builders, it’s still rare to see threat actors with deep or sophisticated AI-integration within their attack chains. Even so, AI is still being used for initial access tooling, code generation and scripting support – something we can spot the inclusion of rather easily at this point. Our team believes that 2026 will only see threat actors increase their experimentation within this arena alongside the use of open-source LLMs from platforms such as HuggingFace or disguised connections back to cloud-connected LLMs from the major players in the space, such as OpenAI and Google.
- Voice cloning and video interview fakes will also continue to be an ever more present problem in the coming years as companies deal with increasing adoption of these techniques by North Korean APT groups and other financially motivated threat actors.
- Ultimately, there is no replacing the human element within the threat hunting process, so we don’t believe it will ever be fully automated. However, there is no denying that it will increasingly be used to augment defenders’ capabilities and to empower human experts to have even higher impacts at even greater scales. It is important to bear in mind that attackers are always evolving their techniques and adapting their tactics to new technologies, and so defenders must embrace the same mindset in order to not only keep pace, but to stay ahead.
Residential proxy usage by threat actors will continue to scale along with hopefully increased attention from law enforcement on this growing criminal sector that impacts regular people, corporate targets, and major ISPs alike.
We’re now several years since the 911 S5 Proxy botnet takedown of 19 million devices. And as we expected, threat actors are continuing to scale up similar networks by bundling their illicit residential VPN software with malware, freeware, and other various schemes to get them deployed across both home and corporate networks.
- Unsecured edge devices, routers, and home IOT devices will continue to be a target surface of high interest for threat actors attempting to build botnets, and our team continues to see them used to support corporate attacks, scale residential proxy networks, engage in ad fraud schemes, and more.
- North Korean threat actors will also continue to heavily use proxy and VPN providers to attempt to obscure the origination point of their attacks, with Astrill VPN being one we have called out specifically in the past. Organizations targeted by malicious DPRK campaigns should take note of the available opportunities out there to identify these campaigns in their earliest stages with the right access to the proper data, contextual information, and intelligence products.
Ransomware will continue to thrive and impact organizations of all sizes.
- Despite this, we believe law enforcement will continue to see success in taking down members of Scattered Spider and other threat actors associated with The Com, though it will likely remain difficult to stop Russian ransomware or bring other global threat actors to justice. We are optimistic that 2026 will lead to the identification, indictment, and arrest of those behind ransomware as these criminals are brought within the long reach of the law. Based on current trends, we will likely continue to see young people taking part in these serious ransomware attacks simply due to the large amounts of money made in doing so and the current scale of the communities participating in these attacks.
- We hope elected officials across the world will take these threats more seriously, whether by increasing penalties for participating in ransomware operations or increasing the budgets available for law enforcement to effectively combat the harsh impacts these attacks have on companies and the public.
Supply chain attacks and vendor attacks targeting client data for ransom will continue with renewed vigor.
- Regrettably, 2025 saw significant numbers of supply chain attacks leading to extremely serious ransomware incidents, further underscoring that the targeting of support vendors is a reliable attack strategy for criminal groups. We suspect that open-source code attacks will also continue, with worms like Shai Hulud showing how even simple code can have a substantive impact. In addition, we expect to see more novel supply chain attacks via browser plugins and extensions, as well as via prompt injection attacks targeting emerging AI-centric browsers.
- Most supply chain attacks in 2025 focused on acquiring cryptocurrency either directly from targeted users or through corporate ransomware efforts. We expect threat actors will continue to be arrested for operational security (opsec) mistakes when trying to launder or cash out their take from these attacks. We also expect to see more threat actors from the larger hacks fall for money laundering honeypots set up by law enforcement and encourage those efforts to continue. Crypto laundering tools like Tornado Cash and similar efforts will no doubt also remain in use. 2026 will also see more countries pushing back, like Canada now stepping in to enforce their anti money laundering laws which included their takedown of the TradeOgre Exchange, which resulted in seizing $56 million dollars.
Despite all of this, post-attack remediation will still provide opportunities for defenders to pivot towards proactive threat hunting.
- An adversary that has already left the system still presents a significant risk for an organization, either due to the data stolen or the vulnerabilities they discovered along the way leaving new opportunities for later access. Remediation operators should keep these possibilities in mind as they accomplish their mission, and push for the discovery of other infrastructure an attacker may have laid in waiting for the next wave of attacks.
- If a company has the appropriate data retention and collects the right data in the first place, then past activity will remain well within the realm of a successful threat hunting pivot to pre-emptive defense. In our experience, these artifacts are likely to show up in the outbound network logs correlated with our malicious infrastructure data, something we see often when onboarding a new customer who is connecting to our data for the first time.
Overall
These trends paint a dark picture of an increasingly complex and murky landscape that organizations and their defenders will be forced to navigate, whether they are ready or not, in the New Year. Adopting preemptive and proactive methods and mindsets is the best way to secure an organization and keep businesses operating unimpeded in the face of relentless, ever-evolving adversarial infrastructure.
##
ABOUT THE AUTHOR
As Director of Threat Intelligence at Silent Push, Kasey Best leads a global team of threat hunting experts to provide customers with Indicators of Future Attack (IOFAs) at scale as well as build out meticulously detailed reports on the malicious network infrastructure used by a variety of APTs. He has a proven track record stemming from well over a decade of leading interdisciplinary and multi-agency teams within the cyber security field, providing critical intelligence for the federal government and its IC partners. His expertise lies in threat intelligence and network analysis, malware analysis, cloud forensics, technical project leadership, generational model (i.e. LLM) engineering, and project management. He speaks four languages, is both CISSP & PMP certified, and has received a Bachelor’s of Science in Business Administration.
