Phishing Returns as the Leading Initial Access Vector and Public Administration Remains a Prime Target in Cyber Attacks

As we step into 2026, cybersecurity trends from the first quarter reveal a significant pivot in how adversaries are accessing systems. Phishing has reemerged as the predominant method of initial access, marking a shift in tactics observed since the second quarter of 2025. In fact, phishing accounted for over one-third of engagements where initial access vectors could be assessed. This uptick in phishing activity aligns with a concurrent rise in attacks targeting public administration and healthcare sectors, both of which tied for the most attacked industries at 24% each.

Phishing Tactics: The Use of AI Tools

A particularly concerning trend is the use of AI tools in phishing campaigns. During this quarter, Talos Incident Response (Talos IR) encountered a campaign that employed the Softr AI-based web application development service to create malicious credential harvesting pages. This campaign primarily targeted users of Microsoft Exchange and Outlook Web Access. The leveraging of AI tools by adversaries is noteworthy as it marks the first documented case of such a specific tool being used in a phishing attack.

Adversarial groups, including state-sponsored actors, have increasingly been utilizing large language models (LLMs) to enhance their phishing strategies. This encompasses crafting more persuasive phishing lures and automating malicious scripts. The capability to create phishing sites through simple AI prompts reduces the barrier for entry for less sophisticated attackers, allowing them to execute attacks that might otherwise require technical expertise. For instance, through Softr’s template options, attackers can develop landing pages within minutes, capturing sensitive user data without any coding experience, and redirecting this data to disposable storage solutions, such as Google Sheets.

Crimson Collective: A New Threat Emerges

In an alarming development, Talos IR documented its first incident linked to the Crimson Collective, a cyber extortion group that first appeared in September 2025. This case highlighted the use of compromised valid accounts for initial access, a method that became the second most common type of entry, comprising 24% of engagements this quarter. Such tactics saw attackers exploiting known vulnerabilities to gain foothold within targeted environments.

The incident originated from a GitHub Personal Access Token inadvertently exposed on a public forum. This oversight provided adversaries with months-long access to scan for additional sensitive data using legitimate tools like TruffleHog, typically employed by security professionals. This enabled attackers to unearth client secrets and further infiltrate Azure cloud storage, demonstrating an alarming trend—threat actors are increasingly adopting legitimate tools to conduct malicious activities without raising early alarm bells.

In addition to data exfiltration, attempts were made to introduce malicious code into public repositories, aimed at capturing future exposed secrets. While security measures largely thwarted these attempts, this incident reiterates a growing trend in supply chain and development environment attacks.

Ransomware Trends: A Slight Increase in Pre-Ransomware Incidents

Current Ransomware Landscape

While pre-ransomware incidents have surged slightly, making up 18% of engagements in this quarter, the overall activity related to ransomware remains strikingly low. This quarter saw no actual ransomware deployment, thanks to prompt mitigation efforts by Talos IR. This marks a stark contrast from early 2025, when ransomware incidents accounted for around 50% of engagements.

Some incidents did hint at potential ransomware involvement, specifically by Rhysida and MoneyMessage ransomware variants, but these were contained before encryption could occur. The decline in active ransomware-as-a-service (RaaS) operations, albeit temporary, suggests that while some groups might appear dormant, their infrastructures and data leak sites remain operational and active.

Rhyisida Ransomware's Unique Approach

An interesting pattern displayed by Rhysida actors in recent incidents involved the use of uncommon backdoors, specifically MeowBackConn, in attempts to deploy ransomware. Talos IR attributed this activity to Rhysida based on infrastructure connectivity and the utilization of Gootloader malware, a typical initial access tool for Rhysida-linked activities. Even during pre-ransomware stages, systems displayed vulnerabilities such as exposed management ports, leading to successful lateral movements through the commonly used Remote Desktop Protocol (RDP).

Sector Vulnerability: Public Administration and Healthcare Under Siege

Public administration and healthcare sectors have consistently been on the radar of attackers. These two verticals have emerged as the most attacked sectors for the third consecutive quarter. Organizations within public administration are particularly vulnerable due to generally lower funding and the use of outdated technologies, making them attractive targets for financially motivated and espionage-driven groups. The presence of sensitive data and the necessity for uptime further enhance their desirability as targets.

Declining Exploitation of Public-Facing Applications

Interestingly, the initial access vector landscape has transformed. Exploitation of public-facing applications, once a leading technique, has seen a dramatic decline from 62% to just 18% this quarter, largely due to the effective implementation of emergency patches and improved security measures. The return of phishing to its previous status suggests that adversaries are adapting to increased defenses and modifying their tactics accordingly.

Recommendations to Mitigate Security Weaknesses

Addressing MFA Weaknesses

This quarter’s report underscored that 35% of incidents involved vulnerabilities related to multi-factor authentication (MFA)—a significant increase from previous quarters. Threat actors have developed new methods to bypass or nullify MFA protections, often registering new devices to compromised accounts or using direct connections to server services that do not require MFA verification. Hence, enforcing strict MFA policies and limiting self-service enrollment capabilities could play a pivotal role in mitigating these risks.

Robust Patch Management Practices

Vulnerable infrastructure vulnerabilities account for 25% of all engagement incidents this quarter, indicating the critical need for organizations to maintain robust patch management practices. Such incidents often included the exploitation of known vulnerabilities in Cisco’s AsyncOS, which affects email gateways, alongside other critical service flaws. Identifying and patching such vulnerabilities can prevent rivals from exploiting known entry points.

Centralized Logging and Monitoring

The importance of centralized logging capabilities also came to light, as 18% of incidents suffered from insufficient logging provisions. Poor logging can severely handicap post-incident investigations, making it harder to track how attacks unfolded. By implementing a security information and event management (SIEM) system, organizations ensure they can maintain an original log record for forensic investigation, even if logs are tampered with during an attack.

MITRE ATT&CK Insights

The report also referenced key findings from the MITRE ATT&CK framework, providing insight into various adversarial tactics. Phishing has displaced the previous dominance of public-facing application exploitation, indicating a marked shift in initial access techniques. Moreover, common attack patterns reveal heavy reliance on standard enterprise remote management paths, such as SMB and RDP, underscoring the need for organizations to assess their defenses against these widely-used administrative techniques.

The Future of Cyber Threats

As the cybersecurity landscape continues to evolve, organizations must remain vigilant. Trends observed in Q1 2026 are indicative of evolving adversarial tactics that critically exploit weaknesses in human behavior and infrastructure. Organizations must adapt their defenses accordingly, prioritizing multifactor authentication, rigorous patch management, and enhanced logging capabilities to preemptively thwart these emerging threats.