Remote Access Abuse: The Leading Cause of Cybersecurity Breaches

Post Views: 17

2026 Threat Report: Remote Access Tools and Data-Only Extortion on the Rise

The majority of breaches in 2025 were driven by the abuse of remote access tools, according to a recent report by Arctic Wolf.

Shift in Attacker Tactics

The firm’s 2026 Threat Report found that 65% of non-business email compromise (BEC) breaches began with the exploitation of remote access tools, indicating a shift in attacker tactics towards using existing credentials rather than attempting to breach systems through other means.

Surge in Data-Only Extortion

The report also highlighted a significant surge in data-only extortion, which increased elevenfold in 2025 and accounted for 22% of cases.

This trend suggests that attackers are increasingly focusing on stealing sensitive data rather than encrypting it for ransom.

Ransomware Remains a Prevalent Threat

Ransomware remained a prevalent threat, however, with 77% of impacted organizations refusing to pay and negotiated settlements reducing demands by an average of 67%.

Phishing and BEC Incidents

Phishing was a major driver of BEC incidents, with 85% of cases involving phishing attacks that were often amplified by AI-enabled social engineering.

In Australia, small and midsize businesses were disproportionately affected, accounting for 71% of victims.

Threat groups such as Qilin and Akira were active in the region.

Importance of Robust Security Measures

Executives stressed that a proactive approach to security can significantly mitigate the impact of breaches.

Key Statistics

The report’s findings emphasize the importance of implementing robust identity controls, patching, and early detection to reduce the disruption caused by these types of attacks.

In terms of specific statistics, the report found that ransomware, business compromise, and data incidents accounted for 92% of response engagements.

The surge in data-only extortion was a notable trend, and the report’s authors suggested that this shift in tactics may be driven by the increasing difficulty of successfully extorting ransom payments from victims.

Conclusion

Overall, the report provides a comprehensive overview of the current threat landscape and highlights the need for organizations to prioritize robust security measures to protect against these types of attacks.