IBM X-Force 2026 Report Reveals AI-Accelerated Attacks Exploiting Basic Security Gaps as Ransomware Groups Splinter and Multiply
IBM's annual threat index finds vulnerability exploitation now causes 40% of breaches, with 109 ransomware groups active and over 300,000 AI platform credentials stolen.
Overview
The cybersecurity threat landscape in 2025 was defined by a paradox: attackers did not need sophisticated new playbooks when basic security gaps, now discoverable at machine speed, remained wide open. IBM’s 2026 X-Force Threat Intelligence Index, released on February 25, paints a picture of an ecosystem where AI is not creating entirely novel attack classes but is dramatically accelerating the exploitation of familiar weaknesses. Meanwhile, separate research from Index Engines reveals that ransomware itself is undergoing a technical metamorphosis, with polymorphic and shadow-encryption variants rendering traditional detection methods increasingly obsolete.
Vulnerability Exploitation Overtakes All Other Entry Points
The most striking finding in the X-Force report is structural: vulnerability exploitation was the leading cause of breaches in 2025, accounting for 40% of all incidents observed. Attacks exploiting public-facing applications surged 44% year-over-year, driven in large part by missing authentication controls and what IBM describes as AI-enabled vulnerability discovery.
The implications are uncomfortable for enterprise security teams. According to Network World’s analysis of the report, the most common entry points found during X-Force Red penetration testing remain misconfigured access controls, weak authentication practices, and insufficient vulnerability management. Attackers are not inventing new techniques so much as using AI to “analyze large data sets and iterate on attack paths in real time,” as the report states.
Mark Hughes, IBM’s Global Managing Partner for Cybersecurity Services, summarized the dynamic bluntly: “Attackers aren’t reinventing playbooks, they’re speeding them up with AI.”
Ransomware Groups Splinter Into 109 Factions
The ransomware ecosystem underwent significant fragmentation in 2025. IBM X-Force tracked 109 distinct ransomware and extortion groups, up from 73 in 2024 — a 49% surge. Yet the dominance of the top ten groups fell by 25%, suggesting that the barriers to entry for ransomware operations have lowered substantially. Smaller, more opportunistic operators now populate a landscape that was once dominated by a handful of well-organized criminal syndicates.
Publicly disclosed victim counts rose roughly 12%, but the splintering of the ecosystem means that no single group commands the same outsized share of incidents. The result is a diffuse and harder-to-track threat environment.
AI Platform Credentials Become a High-Value Target
Perhaps the most forward-looking finding concerns the intersection of credential theft and AI adoption. IBM X-Force documented that infostealer malware led to the exposure of over 300,000 ChatGPT credentials on dark web marketplaces in 2025. This signals that AI platforms have reached the same credential risk profile as any other core enterprise SaaS tool.
The danger extends beyond simple account access. Compromised AI platform credentials allow attackers to manipulate model outputs, exfiltrate sensitive data that users have shared with chatbots, and inject malicious prompts. As organizations feed proprietary data into AI assistants, stolen credentials create attack surfaces that did not exist two years ago.
IBM’s report warns that “protecting identities has always posed a challenge. It’s about to get harder,” and recommends combining AI-powered identity threat detection and response (ITDR) with identity security posture management (ISPM) solutions.
Supply Chain Compromises Nearly Quadruple Since 2020
Large-scale supply chain and third-party compromises have nearly quadrupled since 2020, according to the report. Attackers increasingly target the environments where software is built and deployed, exploiting trusted developer identities, CI/CD pipelines, and SaaS integrations to achieve downstream compromise.
The trend is compounded by the adoption of AI-powered coding assistants. The report notes that these tools can occasionally introduce unvetted code, and that the convergence of nation-state and financially motivated tactics — facilitated through underground knowledge sharing — is accelerating the sophistication of supply chain attacks.
Manufacturing and North America Bear the Brunt
Manufacturing remained the most targeted industry for the fifth consecutive year, accounting for 27.7% of incidents observed by X-Force, with data theft as the primary objective. The sector’s reliance on operational technology and its low tolerance for downtime continue to make it an attractive target for both ransomware operators and state-sponsored actors.
Geographically, North America emerged as the most-attacked region at 29% of total cases, up from 24% in 2024, claiming the top position for the first time in six years.
Ransomware’s Technical Evolution: Polymorphism and Shadow Encryption
Independent of the IBM report, research published by Index Engines on February 24 underscores just how rapidly ransomware is evolving at a technical level. The firm’s CyberSense Research Lab analyzed ransomware samples from Q4 2025 and found that nearly 90% exhibited polymorphic behaviors, meaning the malware dynamically alters its code to evade signature-based detection. Without a single static fingerprint, these variants complicate forensic investigations and increase the risk of reinfection during recovery.
More concerning still, approximately 80% of analyzed variants employed shadow encryption, a 33% increase from Q2 2025. Shadow encryption uses intermittent, partial, or slow encryption to corrupt data over time while evading traditional detection mechanisms. The technique allows ransomware to operate beneath security thresholds for extended periods before the damage becomes apparent.
The research also flagged two emerging attack patterns: directory-structure attacks that target entire data groupings rather than individual files to maximize disruption, and wiper-style ransomware that prioritizes destructive data corruption over financial extortion. “The only way to stay current with emerging ransomware variants is to build a lab that analyzes them daily,” said Jim McGann, Index Engines CMO.
What We Don’t Know
The IBM X-Force report draws on incident response data, dark web monitoring, and penetration testing engagements, but it necessarily reflects only the attacks that IBM’s teams directly observed or that were publicly disclosed. The true scope of credential compromise for AI platforms is likely larger than the 300,000 figure cited, given the volume of infostealers in circulation. Similarly, the Index Engines data comes from controlled lab analysis rather than in-the-wild incident response, meaning real-world detection rates for polymorphic ransomware may differ from research conditions.
The 109 ransomware groups tracked by IBM represent named operations; the actual number of actors using ransomware toolkits is almost certainly higher. How quickly shadow encryption techniques will propagate from specialized variants into commodity ransomware-as-a-service offerings remains an open question.
Analysis
Taken together, these reports describe a threat landscape where the fundamental problem has not changed — organizations leave basic security controls misconfigured, credentials poorly managed, and software unpatched — but the consequences of those lapses are compounding at AI speed. The 44% surge in public-facing application exploitation is not a story about a new vulnerability class; it is a story about old vulnerabilities found faster.
The splintering of the ransomware ecosystem into 109 groups mirrors patterns seen in other criminal markets: as tools become commoditized, more actors enter, each targeting smaller but more numerous victims. For defenders, this means fewer opportunities to rely on threat intelligence about a small number of known adversaries and more need for broad-spectrum detection.
The emergence of shadow encryption represents a genuine tactical shift. Traditional ransomware was designed to be loud — locking systems quickly to force payment. Shadow encryption inverts that model, operating silently for as long as possible. This favors attackers who want to maximize the integrity of their leverage (corrupting backups before detection) and complicates the recovery calculus for organizations that believed their backup strategies were sufficient.
The convergence of AI credential theft with the broader identity attack surface is perhaps the most underappreciated risk in the report. As enterprises integrate AI assistants into workflows involving sensitive data, the credential perimeter expands into territory that most organizations have not yet secured with the same rigor as traditional SaaS platforms.