Infoblox, a leading platform for pre-emptive security and critical network services, has announced the release of its 2026 Threat Landscape Report, revealing that cybercrime has evolved into an industrialised criminal economy that enables attackers to operate faster, scale more efficiently and evade traditional defences. Frontier AI, specialised criminal services and hidden infrastructure are accelerating this transformation, compressing the time defenders must respond and exposing the limits of traditional detect-and-respond security strategies.
The report examines cybercrime through four dimensions:
- The industrialised services powering attacks at scale
- The hidden infrastructure enabling evasion
- The evolving lures reaching victims
- The expanding attack surfaces opening new footholds inside the enterprise
Together, these four perspectives reveal how modern cybercrime operates and what organisations must do to stay ahead of it.
Drawing on trillions of DNS queries, billions of underground criminal transactions and extensive threat research, Infoblox Threat Intel identified the trends reshaping how modern cybercrime operates, finding that:
- Nearly 25% of 120 million newly observed domains were high or critical risk, reflecting the massive scale of disposable infrastructure fuelling modern cybercrime.
- The most prevalent threat, impacting more than 95% of networks, was traffic distribution systems (TDSs), ubiquitous and difficult-to-detect infrastructure that routes victims to targeted malware, phishing and scam attacks.
- Eighty-eight percent of threat-related domains were observed in only one customer environment, while 44% were active for just a single day, illustrating the scale of domain weaponisation and the growing reliance on short-lived infrastructure designed to outpace defenders.
- Sixty-five percent of Infoblox Threat Defence customers queried domains associated with residential proxy networks, which attackers use to disguise malicious activity as legitimate consumer internet traffic, allowing attacks to blend into everyday internet activity and evade detection.
- Scam-related domains increased 62% year on year, driven by brand impersonation, identity theft and financial fraud.
“This year’s report documents the cybercrime machine, a globally connected criminal economy where frontier AI, specialised criminal services and hidden infrastructure have transformed how attacks are created, purchased and deployed,” said Dr Renée Burton, Vice President, Infoblox Threat Intel. “The most important shift is not that attackers have become more sophisticated. It’s that sophisticated capabilities have become widely accessible, changing the pace of cybercrime and challenging security strategies built primarily around detection and response.”
The report illustrates how cybercrime has evolved from isolated attacks into an interconnected criminal ecosystem fuelled by specialisation, automation and shared infrastructure. As these capabilities continue to spread, organisations must rethink long-held assumptions about how cyberthreats emerge, spread and can be disrupted.
