LevelBlue TTP Briefing Finds Attackers Now Treat Stolen Data, Not Encryption, as Their Main Leverage
The LevelBlue TTP Briefing for Q3 2026 finds that attackers increasingly rely on stolen data rather than encryption to pressure organisations into paying. Data exfiltration appeared in 83 per cent of investigated intrusions, compared with 67 per cent involving encryption. Attacks involving data theft and extortion without ransomware also increased, highlighting a shift in how threat actors operate.
The latest LevelBlue TTP Briefing finds that attackers increasingly rely on stolen data rather than encryption to pressure organisations into paying. Data exfiltration appeared in 83 per cent of investigated intrusions during Q3 2026, compared with 67 per cent involving encryption. Attacks involving data theft and extortion without ransomware also increased, highlighting a shift in how threat actors operate.
LevelBlue, the world’s largest pure-play managed security services provider, released its Q3 (July to September) 2026 Tactics, Techniques and Procedures (TTP) Briefing. The report examines how attackers compromise organisations, steal information and accelerate their operations.
The findings draw on frontline incident response investigations conducted between July and September 2026. The briefing also incorporates intelligence from SpiderLabs, providing additional insight into emerging threats and attacker behaviour. Cyber News Live previously covered LevelBlue’s Q2 2026 findings, which identified business email compromise and phishing as leading threats.
LevelBlue TTP Briefing: Why Attackers Are Focusing on Data Theft
Data exfiltration overtook encryption as the defining feature of intrusions during Q3 2026. According to LevelBlue, attackers increasingly steal sensitive information and threaten to publish it rather than relying solely on ransomware encryption.
The report identified several changes in extortion activity:
- Data exfiltration appeared in 83 per cent of intrusion cases, while encryption appeared in 67 per cent. Both stood at 77 per cent in Q2 (April to June).
- Exfiltration and extortion-only attacks increased from 23 per cent to 33 per cent, making them the fastest-growing attack type. These attacks involve stealing data and demanding payment without deploying ransomware.
- Attacks combining encryption and exfiltration remained the most common at 50 per cent. However, their share has declined every quarter this year, falling from 60 per cent in Q1 (January to March).
- Files were exfiltrated in 40 per cent of cases where data was at risk, compared with 31 per cent in Q2.
LevelBlue identified Akira, ShinyHunters, Qilin, INC and Helix as the most active ransomware and extortion groups during the quarter.
Why Stolen Identities Remain Central to Cyber Intrusions
Identity-related attacks remained a recurring feature of the incidents LevelBlue investigated. Attackers using legitimate credentials can blend into normal activity without relying heavily on malware, making their behaviour harder to detect.
The report highlighted several findings:
- Business email compromise (BEC) accounted for 32 per cent of engagements, making it the most common incident type. This declined from 45 per cent in Q2 as other incident types increased.
- Attackers bypassed multi-factor authentication (MFA) in 79 per cent of BEC incidents where organisations had deployed it.
- Credential stealers appeared in 67 per cent of cases involving privilege escalation, up from 50 per cent in Q2.
- Abuse of valid accounts as an initial access method increased for the third consecutive quarter.
LevelBlue also observed a change in how attackers bypass MFA. Rather than intercepting authentication tokens, attackers increasingly use voice phishing, known as vishing, to manipulate victims into registering attacker-controlled devices.
Because the legitimate account holder approves the device registration, the resulting access appears authorised. This allows attackers to use trusted identities during subsequent activity.
How Attackers Are Gaining Initial Access
Phishing remained the leading initial intrusion method during Q3 2026. However, LevelBlue found that attackers increasingly exploited internet-facing systems and remote access services to compromise organisations.
The briefing identified three major initial access trends:
- Phishing and social engineering accounted for 42 per cent of initial intrusion vectors, down from 65 per cent in Q2.
- External remote services, including VPN and remote desktop connections, increased from 9 per cent to 14 per cent.
- Exploited vulnerabilities accounted for another 14 per cent, meaning internet-facing access routes represented more than a quarter of initial intrusions.
A critical vulnerability in Metabase, an open-source business intelligence platform, illustrated the risks associated with exposed applications.
During LevelBlue investigations, attackers exploited CVE-2026-72898 (CVSS 10) to create administrator accounts and API keys. They then accessed connected databases and stole information. In some cases, attackers also used the stolen data to extort victims, all through a single entry point.
Technology and software became the most targeted industry for the first time, accounting for 14 per cent of incidents. That represented an increase from 5 per cent in Q2.
LevelBlue also reported that threat actors use AI to search for exposed application programming interface (API) keys. These credentials are often long-lived, have excessive permissions and can bypass MFA.
Attackers Are Moving Faster Through Compromised Networks
The LevelBlue TTP Briefing also found that some intrusions now unfold within hours rather than days. According to the report, attackers increasingly use AI tools to move through compromised networks and accelerate their operations.
The findings show changes in how quickly organisations engage incident response teams following an initial compromise:
- 56 per cent of incident response engagements began within 10 days of compromise, compared with 49 per cent in Q2.
- Engagements beginning within two days more than doubled, rising from 7 per cent to 18 per cent.
- Engagements beginning more than 31 days after compromise declined from 23 per cent to 21 per cent.
- Technology and software was the most targeted industry, followed by healthcare and manufacturing, which tied. Financial services fell from first to fourth place.
- Organisations with annual revenue between US$1 million and US$100 million accounted for the largest share of incidents.
These findings reflect the changing timing and distribution of incidents investigated by LevelBlue during Q3 2026. The report identifies faster attack activity alongside increased data theft, identity abuse, and exploitation of internet-facing systems.
To download the full Q3 2026 Tactics, Techniques and Procedures Briefing, click here.
For more information, visit www.levelblue.com.
About LevelBlue
LevelBlue delivers intelligence-led security with the visibility and speed needed to stop threats faster. As the world’s largest and most analyst-recognised pure-play managed security service provider, our AI-powered managed services help prevent intrusions, strengthen incident response readiness, and accelerate detection and response. We combine government-grade authorisations, globally recognised certifications, and deep cyber expertise to help organisations operate with confidence across regulated, hybrid, and high-risk environments. Learn more at LevelBlue.com.