The cyberthreats shaping 2026 and beyond
Cyberattacks are changing fast. AI is helping threat actors
automate larger parts of the attack lifecycle, identity compromise is opening
new paths into cloud and customer environments and attackers are finding new
ways to disable security controls.
Acronis TRU Cyber Pulse 2026 brings together a year
of Acronis Threat Research Unit (TRU) investigations into incidents, malware
campaigns and threat actors.
Key findings:
- AI is expanding the scale of cyberattacks: A single operator can achieve APT-like scale using AI agents for reconnaissance, exploitation and infrastructure management.
- Identity is becoming a primary target: Infostealers are being used to capture passwords, tokens, session cookies and cloud credentials that extend attacks beyond the original endpoint.
- AI credentials are attracting attackers: Malware is targeting API keys and credential files associated with AI development tools alongside GitHub tokens, cloud credentials and other developer secrets.
- Attackers are targeting the defenses: Defense impairment techniques are being used to disable EDR, logging and other security controls.
- The patch window is shrinking dramatically: Attackers use automation and AI-assisted techniques to accelerate exploit development and attack preparation.
- Ransomware is expanding beyond Windows: Ransomware operators are targeting Linux and ESXi to disrupt virtual infrastructure and the systems organizations depend on for recovery.
Understand the threats shaping 2026 and beyond
Acronis TRU Cyber Pulse 2026 explores what these
developments mean for organizations, MSPs and the customers they protect,
including how defenders can limit the reach of compromised identities, maintain
visibility when security controls are targeted and keep critical services
recoverable during an attack.