Cynet Releases 1H 2026 CyOps ECHO Report: Abused Identities, Gateways, and Trust Take the Place of Exploited Code
Incident responders document how adversaries are gaining initial footholds through stolen or socially-engineered
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
BOSTON, July 29, 2026 (GLOBE NEWSWIRE) — Cynet, the only unified, AI-powered cybersecurity platform empowering security teams to manage the full attack path, today released its 1H 2026 CyOps ECHO Report (Examination of Cyber Hostility and Operations), revealing a shift in adversarial behavior from CVE exploitation to socially engineered sessions, manipulating identities to gain access to environments. The report deconstructs the driving factors of this shift, outlining actual attack chains investigated by Cynet’s CyOps incident response team with practical, actionable intelligence for channel partners and their customers.
“Attackers are increasingly shifting away from breaking security controls and focusing on abusing them as designed,” said Mackenzie Brown, VP of Threat Intelligence at Cynet. “With more advanced AI models lowering the barrier to entry for novice adversaries, and increasing the speed for sophisticated threat actors, closing the gap between how fast attackers move and how fast organizations can respond is imperative for security.”
Identity is the Front Door
In 1H 2026, 80% of host breaches began with stolen identity, at a ratio of 1.6:1 when compared to host-breach cases. Additionally, CyOps found multiple named campaigns in which an attacker initiated contact through Microsoft Teams, impersonating internal IT or help desk staff. Key adversarial tactics include:
- Email Bombing: The target receives a sudden burst of newsletter or subscription emails – frequently dozens to hundreds of messages in a few minutes to manufacture a plausible “noisy inbox.”
- Teams Call Impersonating IT: The attacker dials in from a tenant whose name imitates an internal help desk.
- Quick Assist, AnyDesk, ScreenConnect, or RemSupp Session: Social engineering of the victim into installing or accepting a remote-support session, framed by IT as a means to clean up the flooded inbox.
- Hands-on-keyboard Execution: The attacker drops a payload through the remote session, frequently using DLL side-loading against a signed Windows binary to appear legitimate.
- Privilege Escalation, Credential Access, and Lateral Movement: Engagement from here appears to mimic any other intrusion, except the initial foothold came in through help-desk impersonation, rather than an exploit.
- Entra ID Anomalous User Agent (Axios) Token Abuse: Removes the victimized user from the attack path – with the token replacing the password and the script replacing the human, the session is rarely re-prompted by MFA as it was established legitimately.
“Threat actors targeting individual users in more sophisticated ways call for security teams to double down on verification and authentication,” said Brown. “Employing phishing-resistant authentication, help-desk verification flows, user-agent analytics and shortening the lifetime of session tokens for high-value tenants are all necessary steps for organizations to take to ensure appropriate preemptive defensive measures are in place.”
The Edge is Still the Easiest Way In
Despite identity being the most prolific entry point in 1H 2026, the SSL-VPN appliance was among the most damaging, accounting for 27% of host breaches in the CyOps docket. In cases where ransomware encryption proceeded, the attacker had often crossed the edge before the first on-host signal could fire.
Security teams should protect themselves through issuing regular patches on an emergency cadence when CISA KEV or in-the-wild exploitation is observed, employing phishing-resistant MFA on every SSL-VPN gateway, and continuously hunting for anomalous activity from non-administrator workstations.
Trusted Tools Become Weapons
Attackers are increasingly not writing the malware, they are renting the same remote-support tools the help desk uses, driving them through PowerShell and signed Windows binaries, and loading a kernel driver that someone else already wrote and signed.
Modern attackers are increasingly weaponizing legitimate tools to evade detection and blend into daily operations, reinforcing the need for behavioral visibility and 24×7 human oversight.
For more actionable threat intelligence, download the full 1H 2026 CyOps ECHO Report and subscribe to Cynet’s “Stories from the SOC” newsletter.
About Cynet
Cynet is the leader in attack path management. Cynet’s natively unified cybersecurity platform combines AI correlation with 24×7 CyOps security experts to autonomously remediate 90% of threats with an industry-low false positive rate. Every investigation strengthens future detections to keep defenders faster than the adversary. Headquartered in Boston, Cynet is trusted by thousands of IT channel partners and their customers globally to see the path, stop the attack, and deliver cybersecurity peace of mind. Learn more at cynet.com.
Media Contact
Cynet Communications
press@cynet.com
