Remote Access Abuse:-packed Cybersecurity Threats Drive Majority of Breaches

Post Views: 18

Arctic Wolf 2026 Threat Report Reveals Trends in Cybersecurity

A recent report by Arctic Wolf reveals that the majority of breaches in 2025 were driven by the abuse of remote access tools. The company’s 2026 Threat Report shows that 65% of non-Business Email Compromise (BEC) breaches began with attackers exploiting remote access tools, rather than attempting to breach the network through other means.

Attackers Opt for the Path of Least Resistance

This trend is consistent with the notion that attackers are increasingly opting for the path of least resistance, as noted by Ismael Valenzuela, Vice President at Arctic Wolf, who stated that attackers are

“logging in instead of breaking in.”

Shift in Attacker Tactics

The report also highlights a significant shift in attacker tactics, with data-only extortion surging dramatically in 2025. This type of attack involves stealing sensitive data and threatening to release it publicly unless a ransom is paid, but does not involve the encryption of files. Data-only extortion accounted for 22% of cases in 2025, up from just 2% in the previous year.

Ransomware and Phishing Trends

Ransomware remains a prevalent threat, although the report notes that 77% of impacted organizations declined to pay the ransom demands. In cases where a settlement was negotiated, the average demand was reduced by 67%. Phishing was the primary driver of BEC incidents, with 85% of cases involving phishing attacks that were amplified by AI-enabled social engineering.

Regional Trends

In Australia, small and midsize businesses were disproportionately affected, accounting for 71% of victims. Threat groups such as Qilin and Akira were active in the region. Executives emphasized the importance of implementing disciplined identity controls, patching, and early detection to reduce the disruption caused by these types of attacks.

Broader Trends

The report’s findings are consistent with a broader trend of increased threat actor activity and mega-losses in 2025. A separate report by Dataminr tracked over 5,000 threat actors and logged more than 18,000 ransomware alerts, alongside over 2 million domain impersonation incidents.