ANY.RUN has released its H1 Cyber Risk Report, built on unique data from real-world submissions analyzed in the ANY.RUN Interactive Sandbox from January to June 2026 by over 700,000 analysts and 16,000 SOC teams.
The report highlights 15 key trends and explains what these changes mean for analysts, SOC teams, MSSPs, and business decision-makers. With supporting data and examples, ANY.RUN discuses prevalent attack paths, their practical impact on threat detection, alert triage, investigation, and incident response, as well as proposes mitigation guidance.
Built on Real-World Threat Investigations
Like all ANY.RUN solutions, the H1 2026 Cyber Risk Report is based on threat activity observed across ANY.RUN’s global user base, including SOC teams, MSSPs, enterprise security teams, researchers, and analysts investigating real malware and phishing cases.
ANY.RUN is used by 16K+ organizations and 700K+ security professionals worldwide, including 74% of Fortune 100 companies. Such coverage gives the report visibility into threats submitted across industries, from finance, healthcare, government, IT, and manufacturing to energy and transportation.
Key Shifts Across 6 Months and 15 Trends
Among the key takeaways for security specialists and executives, ANY.RUN highlights three strategic shifts that stand out across all H1 2026 trends.
Attackers are abusing trust at scale
The report shows growth in attacks that rely on hiding malware delivery infrastructures inside trusted channels. In many cases, this means that investigation starts too late, as compromise methods like SEO poisoning, malvertising, and codesigning are shared using commonly used, legitimate services like WhatsApp and PDFtools.
For instance, attacks using Adobe infrastructure grew by 90.7% from H2 2025 to H1 2026, while RMM-related attacks grew by 26.5%, showing how trusted brands and tools are becoming part of the attack path.
Phishing is becoming harder to validate
Custom fake CAPTCHAs grew by 437% from Q1 to Q2 2026, reflecting a broader shift toward phishing flows that are difficult to reproduce, analyze, and connect due to the expected flow being changed.
This includes browser fingerprinting, abusing calendar invites, and device-code phishing. Every method adds more points where visibility can break.
Bypassing attacker evasion often takes interactive sandboxing combined with residential proxies to mask the VM’s nature, as simpler detection logic becomes inefficient when standard heuristics get broken.
Static detection is losing ground
Many attacks now rely on runtime behavior, legitimate services, cross-platform payloads, and dynamic infrastructure rather than static indicators alone. For instance, in Dead Drop Resolvers (DDR) threats, the final C2 may be absent from the sample, complicating detection using static indicators of compromise. It appears only during execution.
For SOC teams, this means hashes, domains, and isolated alerts are no longer enough to understand the full attack chain. It requires shifting from isolated IOCs to the full behavioral chain of C2 resolution.
How to Mitigate with ANY.RUN
The report’s findings point to the need for SOC teams to detect attacks earlier and see more of the attack chain before damage is done.
Across the 15 trends, attackers repeatedly abuse trusted services, legitimate workflows, browser-based flows, identity mechanisms, and dynamic infrastructure to avoid simple detection.
ANY.RUN helps SOC and MSSP teams close these gaps by combining interactive analysis with fresh, sandbox-validated threat intelligence. With ANY.RUN, security teams can:
- Reduce MTTR by 21 minutes per case by quickly reconstructing attack chains across phishing, payload delivery, RMM installation, C2 resolution, and exfiltration.
- Increase detection rate by 36% with deeper visibility into evasive phishing, malware behavior, browser activity, redirects, scripts, and infrastructure links.
- Achieve an MTTD of 14 seconds by safely detonating suspicious files, URLs, phishing pages, and malware across Windows, Linux, Android, and macOS.
- Prioritize incidents with more confidence using Threat Intelligence Lookup, Threat Intelligence Feeds, and expert-led TI Reports to connect indicators with behavioral context and current threat activity.
Conclusion
ANY.RUN’s H1 2026 Cyber Risk Report highlights how phishing, malware, identity abuse, and trusted infrastructure misuse are changing the way SOC teams detect, investigate, and respond to threats. The findings show why earlier detection, broader visibility, and context-rich threat intelligence are becoming essential for modern security operations.
About ANY.RUN
ANY.RUN is a leading provider of interactive malware analysis and threat intelligence solutions trusted by more than 16,000 organizations worldwide, including 74% of the Fortune 100.
Its Interactive Sandbox and Threat Intelligence solutions help SOC teams analyze suspicious files and URLs, uncover malicious behavior, enrich investigations with actionable context, and connect related activity across infrastructure and campaigns.
With deeper visibility and fresh threat context, security teams can reduce investigation time, lower MTTD and MTTR, and contain threats before business impact grows.
FAQ
The H1 2026 Cyber Risk Report is ANY.RUN’s analysis of 15 key cyber risk trends observed in the first half of 2026. It explains how current phishing, malware, identity, and infrastructure abuse techniques affect SOC detection, triage, investigation, and response.
You can access the full report by filling out the form in this article.
The report is based on real-world threat submissions analyzed in ANY.RUN, including activity from SOC teams, MSSPs, researchers, and security analysts worldwide.
The report is designed for CISOs, SOC leaders, MSSP managers, threat intelligence teams, incident response teams, and security professionals who need to understand how current attack techniques are changing.
0 comments