LevelBlue TTP Briefing Q2 2026: Stolen Identities Outpace Defenses

July 23, 2026 · LevelBlue SpiderLabs · Severity: MEDIUM

LevelBlue SpiderLabs' Q2 2026 TTP Briefing highlights a surge in identity-based attacks, with stolen credentials outpacing defensive measures. The report, based on global incident response investigations, reveals that adversaries are increasingly leveraging compromised identities to bypass traditional security controls. Attackers are targeting organizations across sectors, with financial services, healthcare, and critical infrastructure being prime objectives due to their high-value data. Techniques like credential stuffing, pass-the-hash, and token theft are prevalent, often leading to ransomware deployments or data exfiltration. The briefing emphasizes the growing sophistication of identity-focused threats, including the abuse of multi-factor authentication (MFA) bypass tools like Evilginx2 and adversary-in-the-middle (AiTM) attacks. LevelBlue notes a rise in cloud-based identity compromises, particularly in Microsoft Azure and AWS environments, where misconfigured IAM policies are exploited. The report underscores the need for organizations to adopt identity-centric defenses, such as continuous authentication monitoring and privileged access management, to mitigate these evolving risks.

Explore the latest tactics, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing in the quarterly TTP Briefing, a report built on frontline threat intelligence from our global incident response investigations across LevelBlue during Q2 2026.