TL;DR

Picus Labs analyzed 1.15 million files collected in 2025, including 1.08 million classified as malicious, and mapped 15.5 million observed actions to MITRE ATT&CK. In that dataset, eight of the ten most prevalent techniques involved evasion, persistence or command and control. The share of malicious files exhibiting Data Encrypted for Impact (T1486) fell from 21.00% in the prior year’s dataset to 12.94%, a 38% relative decline. These are findings about Picus’s malware samples, not measurements of every intrusion or proof that ransomware has disappeared.

Table of Contents

The Shift: From Predator to Parasite

Ransomware remains a serious threat, but encryption is only one possible attacker objective. Credential theft, stealthy access and data exfiltration also need detection coverage.

Picus Labs calls the pattern in its 2025 malware sample the Digital Parasite: software that uses legitimate processes, identities and services to remain active while avoiding detection. The label is useful for thinking about defensive coverage, but the report’s sampling method does not establish the prevalence of these behaviors across all real-world intrusions.

In Picus’s Red Report 2026 ranking, eight of the top ten techniques fall under defense evasion, persistence or command and control. The ranking is based on the share of malicious files in its dataset that exhibit each technique; it is not a count of attacks or a universal MITRE ATT&CK top ten.

The defensive question is whether controls can detect activity after initial access as well as block the first attempt. A prevalence ranking from malware samples cannot measure attacker dwell time, but it can guide which behaviors a team tests in its own environment.

Picus's Top 10 ATT&CK-Mapped Techniques in Its 2025 Malware Samples

These are the most prevalent ATT&CK-mapped techniques in Picus’s 2025 malicious-file dataset. Percentages represent the share of those samples exhibiting each technique:

RankTechniqueIDPrevalencePrimary Tactic
1Process InjectionT105530.07%Defense Evasion
2Command and Scripting InterpreterT105928.35%Execution
3Credentials from Password StoresT155523.49%Credential Access
4Virtualization/Sandbox EvasionT149721.64%Defense Evasion
5Application Layer ProtocolT107118.93%Command & Control
6MasqueradingT103616.59%Defense Evasion
7Boot or Logon Autostart ExecutionT154715.41%Persistence
8Impair DefensesT156214.18%Defense Evasion
9Remote Access SoftwareT121913.72%Command & Control
10Data Encrypted for ImpactT148612.94%Impact

Process Injection (T1055) holds the #1 spot in Picus’s ranking for the third consecutive year at about 30% prevalence. Nearly one in three malicious samples in this dataset exhibited the technique, making it a useful behavior to validate in EDR and XDR coverage.

Key Findings That Redefine the Threat Landscape

Ransomware Encryption Drops 38%

In Picus’s samples, the prevalence of Data Encrypted for Impact (T1486) fell from 21.00% in the 2024 dataset to 12.94% in the 2025 dataset, a 38% relative decline. That does not measure the number of ransomware incidents. It does justify testing whether defenders can detect credential access, persistence and exfiltration as well as encryption.

This doesn’t mean you can relax your ransomware backup strategy. It means you need to add robust data loss prevention on top of it.

Self-Aware Malware Uses Trigonometry

Virtualization/Sandbox Evasion (T1497) saw explosive growth, surging to rank #4. Modern malware doesn’t just check for sandbox artifacts — it does math to determine if a human is present.

LummaC2 v4.0 calculates the Euclidean distance and angles of mouse cursor movements. If the mouse travels in perfectly straight lines (typical of automated sandboxes) rather than the erratic curves of a human hand, the malware refuses to execute. It plays dead when it detects it’s being watched. This means files can pass through automated security gateways and only activate in production environments.

Stored Credentials in Nearly 1 in 4 Samples

Credentials from Password Stores (T1555) appears in 23.49% of the malicious samples Picus analyzed. That is a sample-level technique prevalence, not a count of attacks against organizations.

Credential dumping (T1003) does not appear in this particular top-ten ranking; that does not mean it has disappeared from intrusions.

Living Off the Cloud

Command and control has evolved beyond suspicious standalone C2 servers. Adversaries are routing traffic through the world’s most trusted cloud services:

  • SesameOp backdoor routed all C2 traffic through OpenAI’s Assistants API, disguising commands as legitimate AI development activity
  • Storm-0501 directly queried AWS Secrets Manager via API to harvest credentials, bypassing endpoint detection entirely
  • LameHug malware used cloud function calls as covert C2 channels

Domain-only blocklists can miss malicious traffic when command and control uses cloud APIs also needed for legitimate work. Egress logs, identity context and unusual request patterns become important alongside controls for C2 that uses third-party infrastructure.

The Physical Insider Threat Goes Hardware

Physical IPKVM devices can provide remote keyboard, video and mouse access to a laptop, including some pre-boot interactions. Endpoint detection alone may not reveal the external device. Physical inspection, USB inventory and network monitoring remain relevant ways to detect or constrain such access.

Blinding the Watchman Is Now Standard Operating Procedure

Impair Defenses (T1562) remains firmly in the Top 10 at 14.18%. Before a parasite feeds, it neutralizes the host’s immune system. The Deadlock ransomware abused legitimate Windows utilities to silently disable Defender’s real-time protection. More alarmingly, RealBlindingEDR tools surgically removed kernel callbacks from EDR agents — leaving them running but completely blind. The agent reports healthy status while seeing nothing.

Masquerading and Persistence Complete the Picture

Masquerading (T1036) entered the top tier at rank #6, with adversaries renaming malicious binaries to look like svchost.exe or update.exe. The Ferocious Kitten campaign used Right-to-Left Override (RTLO) characters to make executable files appear as PDFs — a technique that has been used in pastejacking and social engineering attacks for years but remains devastatingly effective.

Boot or Logon Autostart Execution (T1547) rose to rank #7. Attackers are modifying registry keys and autostart directories to ensure their code survives every reboot — transforming a single breach into a chronic condition.

AI in Malware: Hype vs. Reality

AI claims deserve a separate evidence check. Picus’s technique ranking measures ATT&CK-mapped behaviors in its samples; it does not by itself establish how much AI attackers used across all malware or intrusions.

The high prevalence of Command and Scripting Interpreter (#2) and Process Injection (#1) is a reminder to validate long-standing detections alongside any new AI-related scenarios.

The report supports a narrower operational conclusion: invest in controls for observed behaviors before assuming a new label changes the detection problem.

Recommendations for Security Teams

Based on the behaviors in Picus’s 2025 malware sample, here are eight priorities security teams can evaluate against their own environment:

1. Adopt Continuous Security Validation

Static detections can miss behavior that changes shape. Simulate relevant techniques from Picus’s ranking against your security stack and verify that controls trigger the expected alerts.

2. Combat Process Injection and Living Off the Land

Enforce Constrained Language Mode for PowerShell. Deploy EDR solutions with volatile memory scanning capabilities. Use Attack Surface Reduction (ASR) rules to block Office applications from spawning child processes. Monitor dual-use admin tools (whoami, net group, dsquery) for abnormal usage patterns.

3. Harden Cloud Identities and API Surfaces

Monitor non-human identities aggressively with Cloud Infrastructure Entitlement Management (CIEM). Implement TLS inspection on traffic to trusted cloud APIs. Enforce least privilege for cloud credentials and shorten session lifetimes for cloud access tokens.

4. Operationalize Anti-Evasion Defenses

Move to bare-metal detonation environments — software-based sandboxes are increasingly fingerprinted by malware. If a suspicious file executes but shows no activity, treat it as potential evasion, not a clean bill of health. Hunt for EDR unhooking attempts in memory.

5. Shift from Anti-Encryption to Anti-Extortion

Alongside ransomware recovery planning, test for silent data theft. Implement egress filtering, deploy canary tokens in sensitive repositories, and tune DLP rules to detect data staging behavior (mass file copying, compression before exfiltration).

6. Secure the Physical Layer

Monitor for unrecognized USB devices, particularly those enumerating as keyboards or video capture devices. Enforce BIOS/UEFI passwords and Secure Boot. Implement 802.1x network access control to ensure only authorized hardware communicates on the network.

7. Govern Remote Access Software

Scan for and block unauthorized remote desktop tools (AnyDesk, TeamViewer). Monitor specifically for VS Code Remote Tunnels (code.exe tunnel) — unauthorized tunnels should be blocked immediately. Implement application allowlisting against portable remote access executables.

8. Modernize Identity Defense

Eliminate browser password storage via group policy. Transition to FIDO2/WebAuthn for privileged access. Implement conditional access policies that trigger re-authentication on session token anomalies (new IP, new device fingerprint). Aggressively reduce local admin rights.

Summary

Picus’s dataset highlights stealth and credential access, while its sampling limits prevent a claim about every attacker. The practical takeaways are:

  • Eight of Picus’s ten most prevalent techniques in its 2025 malware samples involved evasion, persistence or command and control
  • T1486 prevalence fell 38% relative to the prior dataset; this is a sample-level change, not a ransomware incident count
  • Process Injection (T1055) at 30% remains the single most prevalent technique for the third straight year
  • Sandbox evasion has gone mathematical — malware like LummaC2 uses trigonometry to detect automated analysis
  • 23.49% of Picus’s malicious samples exhibited Credentials from Password Stores (T1555)
  • Cloud API misuse can blend with legitimate traffic, so pair network data with identity and request context
  • Physical IPKVM devices can bypass endpoint-only visibility; include physical and network controls in the response plan
  • Long-standing techniques remain prevalent in this dataset; test detection coverage before chasing a new label

The report is a useful prompt to test behavioral detection, identity monitoring and recovery together. File-based detections and backups still matter; neither alone tells a team whether an attacker is using valid credentials or living inside trusted processes.

The Digital Parasite doesn’t need to break down the door. It logs in, disables the alarm, puts on a uniform, and gets to work. Your security architecture must be built for that reality.

Sources

  1. Picus Security — Red Report 2026: The Rise of the Digital Parasite (2026) — methodology and sample-level prevalence

  2. MITRE ATT&CK — Process Injection T1055

  3. MITRE ATT&CK — Virtualization/Sandbox Evasion T1497

  4. MITRE ATT&CK — Credentials from Password Stores T1555

  5. MITRE ATT&CK — Application Layer Protocol T1071

  6. MITRE ATT&CK — Impair Defenses T1562

  7. MITRE ATT&CK — Boot or Logon Autostart Execution T1547

  8. MITRE ATT&CK — Masquerading T1036

  9. MITRE ATT&CK — Data Encrypted for Impact T1486

  10. Microsoft Security Blog — Storm-0501 Cloud Credential Harvesting Analysis (2025)

  11. Outflank — RealBlindingEDR: Removing Kernel Callbacks from EDR Agents (2025)

  12. CISA — Advisory on DPRK IT Worker Threat and Hardware Implants (2025)

  1. MITRE ATT&CK Framework — Full Technique Matrix

  2. Picus Red Report 2026 — Full Report Download

  3. MITRE ATT&CK Navigator — Visualize Technique Coverage

  4. Atomic Red Team — Test ATT&CK Techniques in Your Environment

  5. CISA Known Exploited Vulnerabilities Catalog

  6. Sigma Rules — Community Detection Rules for SIEM

  7. LOLBAS Project — Living Off the Land Binaries and Scripts