You are reading insights from our 2026 Threat Report. Access the full report.
CyberCX investigates cyber security incidents that we attribute to a range of threat actor motivations. The most common motivation we encountered was financial, which is consistent with previous years and the cyber incident response industry more broadly.
Notably, the share of incidents where CyberCX was unable to attribute a motivation increased to 35% in 2025, up from 27% in 2024. This is a result of intrusions being detected and contained before the threat actor could display any motive, or CyberCX being unable to make a firm assessment.
Defining threat actor motivation
| Financial | Actors motivated by leveraging their access for financial gain. |
| Espionage | Incidents that involve a threat actor establishing access to systems or stealing information for intelligence purposes and objectives. |
| Retaliation | Incidents resulting from retaliation against an organisation or individual. |
| Unknown | Unknown is classified when the investigator has less than moderate confidence of the threat actor’s motivation. This may be due to the incident being contained before there are actions on objectives or not enough attributable data is available. |
Which industries and sectors are being targeted?
In 2025, Financial and Insurance Services surpassed Healthcare as the most common industry that CyberCX assisted in responding to cyber incidents.
2025
- Financial and Insurance Services: 18%
- Healthcare: 12%
- Education: 11%
- Information Media and Telecommunications: 9%
- Manufacturing: 8%
2024
- Healthcare 17%
- Financial and Insurance Services 11%
- Education 8%
- Information Media and Telecommunications 8%
- Manufacturing 6%
2023
- Healthcare 12%
- Financial and Insurance Services 10%
- Education 9%
- Information Media and Telecommunications 9%
- Manufacturing 9%
Note: the CyberCX DFIR team responds to a number of incidents on behalf of our medical insurance partners, significantly contributing to statistics around Healthcare.
“CyberCX noted a sharp increase in the number of cyber extortion incidents affecting the Financial and Insurance Services industry in 2025.”
Insights into attack type by industry
CyberCX noted a sharp increase in the number of cyber extortion incidents affecting the Financial and Insurance Services industry in 2025, a significant increase from 2024 where it was not listed in the top three for cyber extortion.
Top three industries per attack type:
Espionage
|
Cyber extortion
|
Business email compromise
|
The healthcare industry tends to be more significantly affected by BEC compared to other industries. CyberCX believes this reflects the large number of small and medium-sized entities, such as doctors’ practices and clinics, which tend to have a lower maturity security posture and limited guidance on best practices, which are often outsourced entirely to third-party managed services providers.
Why financial services is now the top target
The financial sector remains one of the most heavily targeted industries. It sits at the intersection of high-value assets, sensitive data and time-critical operations; as well as being highly regulated.
Complex digital environments, often spanning third-party infrastructure and legacy systems, represent a broad attack surface for threat actors to exploit.
Sensitive financial and personal information and a perceived ability to pay, make financial services an attractive target for cyber extortion attacks – such as data theft extortion, ransomware or business email compromise.
Education remains a consistent target
Educational institutions tend to have extensive attack surfaces that can include:
- Research environments
- Unmonitored internet-facing assets
- Shadow IT infrastructure
- Student networks
- Bring-your-own-device policies
- Lack of network segmentation
- Limited asset management
While the nature of the data held within these networks make these institutions an attractive target for threat actors and malicious insiders, responding to and investigating these incidents is increasingly challenging for a number of reasons.
These include the broad attack surface and distributed control of systems (typically labs or facilities outside the purview of central Information and Communications Technology (ICT) teams), as well as a history and culture of academic freedom.
Incidents managed by CyberCX
Case study 1
CyberCX responded to a cyber extortion incident impacting an organisation’s network. The threat actor gained initial access through published Remote Desktop Services using valid user credentials. MFA was not enforced on these services. Several Socket Secure (SOCKS) malware variants were deployed to devices following lateral movement, including to the organisation’s hypervisors.
Despite remediation actions occurring, the threat actor was able to persist through redundant malware and account access, at times reenabling and resetting passwords to maintain a foothold. Noteworthy tactics, techniques and procedures (TTPs) from this intrusion included credential extraction from the application database of a backup appliance and attempts to abuse functionality in Windows Media Player to download malware.
Case study 2
CyberCX responded to an incident involving persistent access to an organisation’s network. Initial access was achieved via authentication to Active Directory Federation Services (ADFS) using service accounts with credentials likely known to the threat actor through previous compromise. The threat actor was able to compromise a large amount of Microsoft 365 credentials, continuously swapping accounts as other accounts were remediated.
The threat actor was able to gain a complete picture of the Azure cloud environment using open-source tooling (Azurehound) and Graph Explorer. They were also able to access Azure Bastion hosts directly from the web client and use Bastion Secure Links to laterally move further into the network to accomplish their objectives.
Case study 3
CyberCX responded to a pre-ransomware incident impacting the entire on-premises network of an organisation. The threat actor gained initial access from a user falling victim to a fake CAPTCHA prompt. After a malicious command was executed, two Command and Control (C2) tools were immediately installed, one of which was a legitimate remote monitoring and management (RMM) tool with malicious configuration files.
Our team was able to respond to this incident before ransomware was deployed. However, by the time the incident had been contained, the threat actor had interacted with almost every device in the network, looking for documents on user devices using an automated discovery and exfiltration script. Noteworthy TTPs from this intrusion included the use of automated scripts for discovery and exfiltration, legitimate RMM tools, and the use of the legitimate forensic tool, Volatility, to extract credentials from a Domain Controller.
How to protect your organisation, regardless of threat motivation
- A defence in depth approach with multiple layers of controls gives organisations the best chance of defending against the full range of attacks. This includes educating staff on how to spot new types of phishing and social engineering campaigns.
- These case studies highlight the importance of having a comprehensive and complete remediation strategy. Responders should avoid making assumptions about what is and isn’t possible to compromise. Victim organisations should assume full compromise and perform full remediation, otherwise there remains a risk that the threat actor may not be completely evicted from the environment.
- We recommend obtaining expert assistance when conducting remediation activities.
Access the full 2026 Threat Report
“We have seen firsthand how these stealthy actors live off the land. Worryingly, we have also seen state sponsored espionage actors caring less if we do detect them. This change in operational posture is the cyber equivalent of: “what are you going to do about it?”
The theme is clear: the threats are bigger and better resourced, and the risks are worse than they have ever been.
This underscores the value of this Threat Report. The data it’s built on is real and current, the insights and trends identified are truly hard won. At a time where the global threat landscape is deteriorating and the nature of the threat worsening, we hope that you will read this report and come away better equipped and prepared to weather the storm.”
Hamish Krebs
Global Executive Director, Digital Forensics and Incident Response, CyberCX
