2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface

Core Insights - The 2026 CrowdStrike Global Threat Report highlights that AI is significantly accelerating adversarial activities and reshaping the attack surface, with AI-enabled attacks surging by 89% year-over-year [1][1][1] Summary by Categories AI and Cybersecurity - AI-enabled adversaries have increased operations by 89%, utilizing AI for reconnaissance, credential theft, and evasion [1][1][1] - The average eCrime breakout time has decreased to 29 minutes, a 65% increase in speed from 2024, with the fastest breakout recorded at just 27 seconds [1][1][1] Vulnerabilities and Exploitation - 42% of vulnerabilities were exploited before public disclosure, with adversaries leveraging zero-day vulnerabilities for initial access and privilege escalation [1][1][1] - Cloud-related intrusions rose by 37%, with a notable 266% increase in attacks from state-nexus threat actors targeting cloud environments [1][1][1] Geopolitical Threats - China-nexus activity increased by 38% in 2025, particularly in the logistics sector, which saw an 85% rise in targeting [1][1][1] - DPRK-linked incidents surged over 130%, with the FAMOUS CHOLLIMA group doubling its activity, including a significant $1.46 billion cryptocurrency theft [1][1][1] AI as a Target - Adversaries are exploiting legitimate GenAI tools at over 90 organizations by injecting malicious prompts to generate commands for credential and cryptocurrency theft [1][1][1] - AI development platforms are being targeted to establish persistence and deploy ransomware, with adversaries creating malicious AI servers to intercept sensitive data [1][1][1]