Lumu’s newly released 2026 Compromise Report reads less like a technical whitepaper and more like a field manual from a war that has already moved indoors. The cybersecurity company, known for pioneering Continuous Compromise Assessment®, lays out a stark shift in how attacks are happening and, more importantly, how defenders must think. The era of noisy intrusions, obvious malware, and dramatic breaches is fading. What’s replacing it is quieter, slower, and far more unsettling: attackers already inside the network, blending into normal traffic, behaving like legitimate tools, and waiting patiently. North America emerges in the report as the global epicenter for high-value targets, not because it is weaker, but because it is richer in digital infrastructure, better connected, and therefore far more lucrative for modern ransomware operations that chase large payouts rather than sheer volume.
The report identifies four dominant threat categories shaping today’s compromise landscape: anonymizers, droppers and downloaders, infostealers, and ransomware. Together, they form a chain of activity designed to avoid detection at every step. Ricardo Villadiego, founder and CEO of Lumu, captures the shift bluntly when he says that defenders can no longer look for enemies at the gate, because the assumption must now be that the enemy is already inside. Attackers, he explains, have traded brute-force methods for behavioral evasion, hiding inside legitimate tools, network noise, and even marketing infrastructure. VPNs, DNS tunneling, traffic distribution systems, and AI-generated domains have become the camouflage of choice, allowing malicious activity to flow alongside normal business operations without triggering alarms.
One of the most telling signals in the report is the change in attacker priorities visible through MITRE ATT&CK data. Command and Control has replaced Execution among the top techniques, meaning attackers are less focused on immediately running destructive code and more obsessed with maintaining a silent, persistent connection into networks. That quiet lifeline is everything. Once established, it allows adversaries to observe, map, and wait, turning time into their greatest weapon. This “low-and-slow” approach aligns perfectly with Living-off-the-Land tactics, where attackers rely on built-in system tools rather than introducing foreign code that might raise suspicion.
Anonymization stands out as the most consistently detected indicator of compromise throughout the year, reinforcing how foundational it has become to modern attacks. Tor, private VPNs, and similar services are no longer edge cases; they are default infrastructure for threat actors. Even more unsettling is the weaponization of legitimate systems. Lumu reports that Keitaro, a traffic distribution system widely used by marketers, has become the most frequently detected dropper. Attackers now use it as a velvet rope, selectively routing victims to malware only when conditions are perfect, keeping exposure minimal and detection difficult.
The infostealer ecosystem also shows a worrying resilience. Despite the takedown of Lumma Stealer as a malware-as-a-service operation, Lumu sensors detected new, hardened Lumma infections as recently as July 2025, proving that takedowns alone no longer end threats. At the same time, new credential stealers like MagentoCore, Remo, and Ramnit have entered the field, diversifying the risk and making attribution even harder. On the ransomware front, fragmentation is the defining theme. Large, well-known gangs have splintered into smaller groups, with DeathRansom emerging as the most prominent among them. This decentralization makes disruption harder and increases unpredictability, as each group evolves its own playbook.
What the 2026 Compromise Report ultimately makes clear is that cybersecurity has shifted from prevention to continuous awareness. Persistent monitoring, tight integration between tools, and actionable intelligence are no longer best practices; they are survival requirements. Lumu’s message is uncomfortable but necessary: compromise is no longer an event you wait for, it’s a condition you must continuously measure. The attackers have learned how to hide in plain sight, and the only way forward is to accept that reality and build defenses that assume silence is not safety, it’s a warning.