During the first quarter of 2026, the global threat landscape experienced a significant shift as cybercriminals increasingly turned to low-noise, highly evasive attack methods.
Based on an extensive analysis of over 2.1 million malware and phishing investigations, new threat intelligence reveals that attackers are aggressively weaponizing legitimate system tools to bypass traditional enterprise defenses.
The Q1 2026 Cyber Risk report was recently published by security firm ANY.RUN highlights critical visibility gaps that directly impact business resilience.
By combining data-driven insights into malware trends with strategic guidance, the research paints a clear picture of how modern adversaries operate.
Security operations center (SOC) teams are now dealing with an environment in which early-stage compromises rely heavily on stealth, speed, and the exploitation of trusted software.
Legitimate Tools Deploy Malware
One of the most alarming trends identified in the report is the rapidly shrinking window for defenders to detect and respond to security incidents.
The median time for attackers to establish persistence on a compromised network has dropped to just 21 seconds. Furthermore, execution using Living-off-the-Land (LOTL) techniques via native system tools now takes a median time of only 16 seconds.
This drastically reduced timeline means the critical period between initial infection and a firm foothold is almost nonexistent, leaving organizations vulnerable to rapid financial and operational impacts.
Fueling this high-speed attack chain is a massive 98.3% growth in loader-based attacks.
Loaders have become the primary vehicle for early-stage compromise, serving as the silent delivery mechanism for more destructive payloads such as ransomware or data stealers.
The expanding role of these initial access tools highlights a highly efficient cybercrime ecosystem. Threat actors use loaders to quickly breach a network, assess the environment, and deploy secondary malware before security teams can trigger an alert.
Speed and certainty in incident investigation are no longer optional; they are required advantages for any modern security team trying to prevent an incident from escalating.
To maintain this speed and avoid triggering alarms, attackers are heavily prioritizing legitimate tools and valid system identities.
The report notes a 58.4% rise in Living-off-the-Land Binaries and Scripts (LOLBAS) attacks, particularly those leveraging JavaScript.
Because LOLBAS techniques use pre-installed, trusted operating system components to execute malicious commands, they easily blend in with normal administrative activity.
This low-noise approach renders traditional, signature-based detection systems largely ineffective, ANY.RUN said.
Identity abuse remains tightly coupled with these evasion tactics. Investigations showed a 14.7% increase in credential theft activity throughout the first quarter.
By acquiring valid usernames, passwords, and one-time passwords (OTPs), threat actors can log in remotely and move laterally across the network without writing custom exploits.
The growing popularity of combined credential abuse and trusted tool exploitation makes behavior-based monitoring and anomaly detection mandatory for enterprise survival.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
