Industrialized cybercrime is outpacing perimeter and endpoint defences

At a glance

What this is: Infoblox frames the 2026 threat landscape as an industrialized cybercrime economy that uses frontier AI, DNS abuse and resilient infrastructure to evade traditional defence models.

Why it matters: It matters because defenders, including IAM and NHI teams, have to assume adversaries will hide infrastructure and lures outside standard visibility, shifting control value toward discovery, telemetry and preemptive disruption.

By the numbers:

• Infoblox identified 120 million newly observed domains over the past year.
• Infoblox classified 27 million newly observed domains as malicious or suspicious.
• 88% of threat-related domains were seen in a single-customer environment, reducing the reach of traditional detect-and-respond tools.

Context

Industrialized cybercrime is what happens when attack infrastructure, lures and delivery mechanisms become repeatable, scalable and commercially distributed rather than ad hoc. That changes the defender problem from hunting isolated incidents to detecting ecosystems that can be rebuilt quickly after disruption.

The identity angle is indirect but real. When adversaries hide infrastructure, hijack DNS and automate lure delivery, they also increase the odds that stolen access, service credentials and delegated trust will be used inside environments before normal review cycles can react. That makes visibility and rapid containment part of identity governance, not just network security.

The report's starting position is now typical of modern threat activity, not an outlier: scale, automation and stealth are becoming the baseline.

Key questions

Q: What breaks when adversaries can rebuild malicious infrastructure faster than defenders can block it?

A: Static blocklists, reputation checks and manual takedown workflows lose effectiveness when the attacker can rotate domains, hosts and lure content faster than the control plane updates. The result is a visibility-to-action gap where suspicious infrastructure is briefly seen but not contained soon enough to matter.

Q: Why does DNS abuse make industrialized cybercrime harder to stop?

A: DNS abuse gives attackers a low-cost way to route victims, hide infrastructure and shift campaigns without changing the underlying phishing or malware logic. Because DNS is foundational and high-volume, defenders need behavioural correlation and early telemetry rather than relying on isolated indicators or after-the-fact cleanup.

Q: What signs indicate that an organisation is missing hidden attacker infrastructure?

A: Repeated lookalike domains, short-lived hostnames, single-customer sightings and lure traffic that does not match normal business patterns all suggest hidden infrastructure is slipping past controls. When these signals are not joined to identity and endpoint events, attackers can keep reusing the same campaign logic.

Q: How should security teams respond when frontier AI improves lure quality?

A: They should assume the first compromise may be persuasion rather than exploitation, then harden the authentication and approval steps that follow a user interaction. That means phishing-resistant MFA, stronger reporting paths and correlation between identity logs and suspicious domain activity.

Technical breakdown

How DNS abuse supports industrialized cybercrime

DNS sits at a useful layer for attackers because it is both foundational and noisy. Malicious infrastructure can be registered, rotated and abandoned quickly, while lookalike domains and short-lived hostnames help campaigns evade static blocklists and perimeter controls. In practice, DNS becomes part of the attacker's command, redirection and deception fabric, not just name resolution. That matters because defenders often inspect endpoints after the lure has already executed, while DNS telemetry can expose intent earlier in the kill chain.

Practical implication: Correlate DNS telemetry with identity and endpoint signals so suspicious infrastructure can be blocked before execution paths are completed.

Why frontier AI changes lure quality and scale

Frontier AI lowers the cost of producing convincing phishing content, multilingual lures and campaign variants. The technical shift is not only better wording, but faster iteration across message, domain, hosting and delivery patterns, which makes signature-based defenses less durable. Attackers can test and adapt lures far faster than human defenders can manually tune campaigns. For identity teams, that raises the chance of credential theft through persuasion rather than exploit, especially where single sign-on and delegated access make a captured account immediately useful.

Practical implication: Treat lure generation as an operational capability and harden authentication paths that assume users will reliably spot deception.

What resilient attacker infrastructure means for detection

Resilient infrastructure is designed to survive takedown, sinkholing and reputation-based blocking. Attackers spread services across hosting providers, automate domain churn and use single-customer or low-visibility environments to keep each artifact from looking broadly malicious. That makes traditional detect-and-respond tools less effective because they rely on reusable indicators and shared visibility. The underlying problem is not just volume, but compartmentalisation: each campaign fragment looks small until the pieces are correlated across time and data sources.

Practical implication: Build detection around relationships and behaviour, not only reputation, because isolated indicators now age out before they are broadly useful.

Threat narrative

Attacker objective: The objective is to run scalable, hard-to-disrupt campaigns that evade perimeter controls, capture trust and sustain repeated intrusions or fraud.

1. Entry begins when attackers register or repurpose infrastructure at scale, using DNS and adtech-adjacent services to place lures where targets will resolve them.
2. Credential or trust abuse follows when deceptive lures and hidden infrastructure persuade users or systems to interact with attacker-controlled destinations, enabling access capture or delivery of malicious payloads.
3. Impact is the persistence of campaigns that evade standard disruption, allowing repeated fraud, theft or intrusion across multiple environments.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Industrialized cybercrime now behaves like an identity and infrastructure supply chain. The report's central message is that attackers no longer need a bespoke campaign for each target. They can industrialise lure creation, domain churn and hosting resilience, then reuse those capabilities across victims. For IAM and NHI practitioners, that means the trust surface extends beyond the account itself to the infrastructure that delivers, validates and operationalises access.

DNS visibility is becoming a governance control, not just a network control. When attack infrastructure can be created and discarded faster than traditional detections mature, the important question is whether an organisation can see suspicious resolution patterns early enough to contain the blast radius. That is why DNS telemetry should be treated as part of control assurance across security operations, identity workflows and fraud response. The practical conclusion is to connect identity events to domain and infrastructure intelligence.

Preemptive security is the right response to adversarial frontier AI because reaction loses the timing race. The report shows that AI-assisted attacker workflows compress the interval between lure creation, infrastructure launch and victim interaction. That weakens models built on post-event cleanup and periodic review. The named concept here is visibility-to-action gap: the delay between first observability and meaningful containment. Practitioners should measure whether they can act before attacker infrastructure becomes operationally useful.

Identity programs need to assume that deception, not exploitation, is often the first compromise step. In modern campaigns, the route to account abuse is increasingly social and infrastructural rather than purely technical. That changes how we think about human identity, MFA fatigue, delegated trust and service-account exposure, because a compromised user or token becomes the quickest path to impact once attacker infrastructure is in place. The conclusion is that identity governance must include upstream threat intelligence inputs.

What this signals

Visibility-to-action gap: the time between first sighting of suspicious infrastructure and effective containment is now a critical control metric. If defenders can see malicious domains but cannot correlate them quickly to identity events, endpoint signals or hosting patterns, the adversary keeps the initiative.

AI-generated lures are shrinking the margin for human judgment, which means the practical control point is moving upstream into authentication design, reporting paths and automated correlation. Organisations that still rely on users to recognise deception will continue to absorb avoidable compromise.

A mature programme should treat DNS intelligence, identity telemetry and response orchestration as a single operating picture rather than separate tools. That is the difference between observing industrialized cybercrime and actually disrupting it.

For practitioners

• Prioritise DNS telemetry in detection engineering Feed DNS query, resolution and domain-age data into SIEM and threat hunting workflows so short-lived attacker infrastructure is visible before it becomes a live campaign.
• Correlate identity events with infrastructure signals Join authentication logs, token use and privileged session activity with domain reputation and hosting patterns to catch account abuse tied to malicious destinations.
• Hunt for single-customer threat infrastructure Flag domains and services that appear isolated to one environment, because the report says 88% of threat-related domains were seen in a single-customer environment.
• Tighten controls around deceptive lures Strengthen user reporting, phishing-resistant authentication and privileged approval flows so convincing AI-generated lures cannot immediately translate into usable access.

Key takeaways

• Industrialized cybercrime is shifting the defender problem from isolated incidents to repeatable attacker ecosystems that can regenerate infrastructure quickly.
• The report cites 120 million newly observed domains, 27 million classified as malicious or suspicious, and 88% of threat-related domains seen in a single-customer environment.
• Teams that combine DNS intelligence with identity telemetry and rapid response will be better positioned to interrupt campaigns before they become operationally useful.

Key terms

• Industrialized Cybercrime: A criminal model that treats phishing, infrastructure and delivery as repeatable production lines rather than one-off attacks. The emphasis is on scale, resilience and rapid replacement of burned assets, which makes disruption harder for defenders that rely on static indicators.
• DNS Abuse: The use of domain name infrastructure to route, conceal or deliver malicious activity. In practice, this includes lookalike domains, fast-flux style churn, covert resolution paths and reputation evasion that help attackers avoid perimeter controls and extend campaign lifespan.
• Visibility-to-action gap: The visibility-to-action gap is the distance between being able to see an access event and being able to use that information to make a timely governance or security decision. It appears when logging exists but context, staffing or workflows are too weak to convert data into control.
• Single-Customer Environment: An environment in which malicious or suspicious infrastructure appears to be visible to only one victim or tenant. That pattern reduces the usefulness of broad reputation systems because the evidence is too narrow to trigger shared blocklists or widespread detection.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for teams that need to connect identity governance to the broader control stack supporting their programme.