Know the Threat. Outsmart the Attack.

The testing period is over. Threat actors are now building GenAI into their daily operations, from faster phishing kits to automated vulnerability scanning and malware that learns as it goes.

Key Takeaways

• Throughout 2025, social engineering campaigns increasingly used deepfake audio, enabling threat actors to conduct real-time impersonation attacks and make vishing or phishing lures more convincing.
• 86% of security leaders reported at least one AI-related incident in the past year, underscoring how quickly the threat has moved from potential to reality.
• The increasing sophistication of AI-driven fraud schemes, as seen in the remote IT worker case earlier this year, highlights the need for a multi-layered approach to workforce security.

Threat actors aren't just using AI. They are shaping their entire approach around it.

Ransomware and digital extortion (R&DE) incidents are expected to remain elevated. Professionalized ransomware-as-a-service (RaaS) ecosystems, effective strains, and the specialization of affiliates will likely drive high attack volumes, especially in early 2026.

Key Takeaways

• ZeroFox identified an average of533 incidents per monththroughout 2025, compared to an average of 388 per month during 2024—which was already a record-breaking year.
• Manufacturing organizations are very likely to face the biggest threat from R&DE actors throughout 2026, continuing a trend observed across 2024 and 2025.
• Ransomware targeting of North America-based organizations has remained on an upward trajectory since early 2022, likely due primarily to the increasing professionalization of DDW marketplaces, the efficacy of extortion collectives, and access brokers pursuing lucrative targets.
• In parallel, the 2025 Verizon DBIR reported that ransomware appeared in 44% of all breaches, reinforcing its role as one of the most persistent and disruptive forces in cybercrime.

Ransomware shows no signs of slowing. As affiliates mature and marketplaces scale, extortion remains one of the most attractive and adaptable criminal business models heading into 2026.

Deep and dark web (DDW) ecosystems will remain central to cybercrime in 2026, but the rules are shifting. Marketplaces are decentralizing, operators are adopting stronger operational security measures, and new affiliates are emerging as collectives splinter and reform.

• Prominent threat collectives continued to fragment throughout 2025, reshaping alliances, affiliate programs, and marketplace structures—a trend expected to deepen in 2026.
• Law enforcement crackdowns and geopolitical stressors are pushing threat actors to migrate from traditional DDW forums to encrypted apps, driving a more decentralized criminal ecosystem.
• DDW marketplaces areincreasingly professionalized, with service desks, ticketing workflows, ratings, subscription tiers, and refund guarantees, mirroring legitimate commerce.

As DDW ecosystems evolve, threat actors gain new ways to collaborate, monetize access, and avoid detection, fueling a criminal economy that is becoming more agile.