Cyber: From Ransomware To Residency: Inside The Rise Of The Digital Parasite

Are ransomware and encryption still the defining signals of modern cyberattacks, or has the industry been too fixated on noise while missing a more dangerous shift happening quietly all around them?

According to Picus Labs’ new Red Report 2026, which analyzed over 1.1 million malicious files and mapped 15.5 million adversarial actions observed across 2025, attackers are no longer optimizing for disruption. Instead, their goal is now long-term, invisible access.

To be clear, ransomware isn’t going anywhere, and adversaries continue to innovate. But the data shows a clear strategic pivot away from loud, destructive attacks toward techniques designed to evade detection, persist inside environments, and quietly exploit identity and trusted infrastructure. Rather than breaking in and burning systems down, today’s attackers increasingly behave like Digital Parasites. They live inside the host, feed on credentials and services, and remain undetected for as long as possible.

Public attention often gravitates toward dramatic outages and visible impact. The data in this year’s Red Report tells a quieter story, one that reveals where defenders are actually losing visibility.

For the past decade, ransomware encryption served as the clearest signal of cyber risk. When your systems locked up and your operations froze, compromise was undeniable.

That signal is now losing relevance. Year over year, Data Encrypted for Impact (T1486) dropped by 38%, declining from 21.00% in 2024 to 12.94% in 2025. This decline doesn’t show reduced attacker capability. It reflects a deliberate shift in strategy instead.

Rather than locking data to force payment, threat actors are shifting toward data extortion as their primary monetization model. By avoiding encryption, attackers keep systems operational while they:

The implication is clear: impact is no longer defined by locked systems, but by how long attackers can maintain access within a host’s systems without being detected.

As attackers shift toward prolonged, stealthy persistence, identity becomes the most reliable path to control.

The Red Report 2026 shows that Credentials from Password Stores (T1555) appear in nearly one out of every four attacks (23.49%), making credential theft one of the most prevalent behaviors observed over the last year.

Source: The Hacker News