In this report_

• Cybercrime economy: theft, extortion and resilience. Stealers are on the rise, facilitating credential theft and monetisation through Malware-as-a-Service (MaaS). Ransomware is evolving and fragmenting to bypass takedown efforts by targeting zero-day vulnerabilities in critical infrastructure.

• Main targets: OT and high-tension events. Attacks on industrial and telecom infrastructure are multiplying, revealing a shift towards sabotage and espionage. The Salt Typhoon campaign highlights the scale of intrusions in US telecommunications, posing systemic risks for strategic exchanges and essential service continuity.

• Vulnerabilities: AI, phishing to quishing, and fast-paced exploitation. Exploits are reaching a critical level, with attacks directly targeting cybersecurity providers such as Ivanti and Palo Alto, narrowing defenders’ reaction windows.