If there’s one big takeaway from Arctic Wolf’s 2026 Threat Report, it’s that attackers have gotten a lot more practical as one pattern showed consistently – they have geared towards the path of least resistance – logging in with stolen credentials, abusing remote access tools, and walking out with data instead of smashing systems with ransomware.
In 2025 alone, ransomware, business email compromise (BEC), and data-related incidents made up a massive 92% of Arctic Wolf’s incident response work, but what really stands out is how fast data-only extortion has exploded, jumping 11 times YoY as attackers realized that many organizations can now recover from ransomware faster than before. Rather than encrypting files, threat actors are simply stealing sensitive data and threatening to leak it, which puts pressure on victims without the operational mess of deploying ransomware.
About 65% of non-BEC intrusions came from abused remote access technologies like RDP, VPNs, and RMM tools, highlighting a clear preference for low-friction entry points over sophisticated exploits. But it’s not all rainy days and such, as defenses are improving in some areas too, with pre-ransomware activity accounted for 5% of cases, suggesting earlier detection is stopping attacks before encryption happens, and in 77% of ransomware incidents, organizations didn’t pay at all. Even when payments did occur, professional negotiation reduced ransom demands by an average of 67%. On the BEC side, phishing was responsible for 85% of incidents, with AI-driven scams making fake messages more convincing and easier to scale than ever.
Another sobering reminder is that all top-exploited vulnerabilities came from 2024 or earlier, which serves as a strong reminder on the importance of basic hygiene like patching and credential rotation. All in all, organizations that prepare for that reality are the ones walking away in much better shape.
