A mid-year threat intelligence review covering H1 2026 trends. Ransomware activity surged with 702 attacks in March alone, dominated by five groups accounting for over 56% of volume. Access brokers have become a key upstream enabler, selling compromised network access before breaches are publicly detected. Identity-based attacks have overtaken malware-first intrusions, with credential theft, MFA bypass, and session hijacking becoming primary vectors. Geopolitical tensions are amplifying cyber operations, with hybrid campaigns blending cyberattacks, disinformation, and kinetic action. AI-driven tooling has shifted from experimental to operational on both offense and defense, with AI-driven ransomware activity up 50% and supply chain attacks spiking 32% above previous records.
