Between October 2025 and July 2026, Positive Technologies analyzed malicious activity in corporate network traffic using its PT Sandbox solution. The findings indicate that 26% of all dangerous files identified were Microsoft Word documents or Excel spreadsheets, which attackers frequently use as entry points.
Malware accounted for 75% of all network threats, with Trojans representing 50% of these cases. Other identified threats included data-stealing software (24%), as well as loaders and installers (15%). Ransomware accounted for 4% of threats, while legitimate IT tools, such as Sysinternals, were misused in 8% of incidents.
The financial sector faced the highest volume of threats at 25%, followed by the industrial and IT sectors at 24% each, and government organizations at 10%. Attackers demonstrated seasonal patterns, with financial sector activity peaking in winter, while industrial and government targets saw increased activity in the spring.
Exploits targeting software or hardware vulnerabilities accounted for 5% of threats. Notably, over 96% of these vulnerabilities were identified three or more years ago, making exploit scripts widely available on dark web platforms. In 29% of cases, attackers used .exe files to gain initial access, often masking them with double extensions.
