When security teams talk about attack surface, the conversation usually starts in familiar places. Servers, identity systems, VPN access, cloud workloads, maybe browsers. Those are visible. They show up in diagrams and asset inventories.
What gets less attention are the everyday tools people use to actually get work done.
PDF readers. Compression utilities. Remote access clients. Word processors. Spreadsheet tools. Email clients. Browsers. Screen sharing software. Update managers. The background software that quietly powers normal business activity.
Most organizations do not spend much time debating whether to deploy these. They are simply part of operating in a digital economy. Contracts arrive as PDFs. Finance works in spreadsheets. HR reviews resumes. IT supports users remotely. Executives live in email and browsers. These tools become part of the environment almost by default.
Advertisement
At Action1, where visibility into third-party software exposure across endpoints is a daily focus, these background tools consistently emerge as a defining part of the real-world attack surface.
That commonness is what makes them attractive targets from a threat actor’s perspective.
The value of being ordinary
From the outside, modern enterprises look different. Networks vary. Architectures change. Security stacks evolve. But, inside most environments, the same classes of applications appear again and again, and more often than not, the same software titles dominate the majority of installations.
It is difficult to function in modern business without an email client, document processing software, a browser, and tools for packaging, previewing, and sharing files. Using similar products is less about preference and more about compatibility.
Advertisement
Business depends on exchanging information in formats everyone else can use. Without those standards, we go back to the days of file-format wars, “I cannot open that, we use something else,” and lost time just trying to make data usable. That friction is why the industry standardized, and why the same major names still dominate.
Attackers pay attention to that.
Rather than predicting every custom application an organization might run, they look for overlap. If a vulnerability appears in a widely used PDF engine, spreadsheet parser, email preview component, or remote access utility, the chances it connects with something real are high. The exploit is aimed less at unique architecture and more at familiarity.
Most successful exploitation does not rely on exotic techniques. It relies on muscle memory. Users open PDFs, Word files, spreadsheets, and links all day long. Attackers are betting those actions feel routine enough that nobody hesitates.
Advertisement
That familiarity shapes how campaigns are built, and it should influence how defense strategies are planned.
Good thing Action1 does it for you, now on Linux too—alongside Windows, macOS, and third-party apps.
One platform. Zero infrastructure. Real-time visibility. Finally, patching that just works.
Many attacks historically looked like guesswork. An attacker might send a crafted email for Outlook, hoping the recipient uses Outlook. Or attach a weaponized spreadsheet, hoping Excel is present. Or send a malicious PDF, hoping the reader is vulnerable.
Advertisement
There is uncertainty in that approach. The exploit launches before the attacker truly knows what exists on the other end. This increases chances the attack will be detected before being effective, and it risks valuable exploit code to failure, where it may be detected, profiled, then henceforth scanned and detected.
What changes with common utilities is the probability curve.
Email clients, browsers, word processors, spreadsheets, PDF readers, and archive tools appear in most business environments because the work itself requires them. An attacker does not need perfect information to expect something compatible nearby.
Instead of treating exploitation as a one-off guess, attackers think in likelihood. They invest effort where overlap is largest. The more widespread the tool, the more attractive it becomes as an entry point.
Advertisement
That is why vulnerabilities in these utilities move quickly through exploit ecosystems. Once something works in a familiar toolchain, it scales. If one user relies on Outlook, Word, and Adobe, there is a good chance coworkers and business relations do as well for interoperability reasons.
Figure 1: Automated detection and remediation of critical vulnerabilities in third-party applications.
The standard business footprint in practice
These tools also travel together.
If an email clearly originated from Outlook, it already hints at part of the environment. Email workflows connect to document workflows. If Outlook is present, Word and Excel are often nearby.
Each utility reinforces the presence of others.
For attackers, that enables paths rather than isolated exploits. An issue in an email client connects to attachment handling, preview engines, document renderers, shared libraries, and integrations that tend to coexist on the same system.
Advertisement
Instead of targeting a single application, the attack surface starts to resemble the business footprint itself, the collection of tools people rely on every day.
When vulnerabilities appear in that footprint, they attract more attention because they fit naturally into how people already work.
Quiet signals and small leaks
Another part of the story is information people do not realize they share.
Documents often contain metadata. PDFs reference the engine that produced them. Spreadsheets carry formatting behavior tied to specific suites. Email headers expose client details. Browser traffic advertises user agents. File structures reveal habits and versions.
Advertisement
A single attachment, email, or shared document can quietly describe parts of the software stack behind it.
In isolation it does not look sensitive. Often it is not even visible. Over time it builds a picture of what tools are common, what standards they follow, and how files are processed.
What created it, what version, how recently, so when old software details show in current workflows, the software processing it is old. And old software often means years of exploit potential bottled up in one package. That is often what turns speculation into precision.
Those breadcrumbs help attackers shape payloads that align with what exists on the other side, increasing effectiveness while reducing noisy experimentation.
Advertisement
Why third-party software drifts
Most enterprises put real effort into operating system patching. Update pipelines are understood. Browsers update often. Mobile devices follow management policies. Systems start with baselines and are monitored.
Third-party utilities live differently.
Vendors ship different installers. Some auto-update. Some rely on users. Some get disabled by packaging systems. Some stay frozen because workflows depend on a version.
Over time, multiple builds of the same tool spread across endpoints. Some become stale. Some live for years with known vulnerabilities simply because they fell off the radar.
Advertisement
In Action1’s analysis of enterprise environments, it is common to find multiple versions of the same third-party application coexisting, some lagging years behind current security fixes. This fragmentation quietly accumulates exploit potential without triggering obvious alerts.
From a security view, that drift matters because attackers do not need new exploits. They benefit from whatever version still exists somewhere in the footprint. A five-year-old PDF reader quietly carries five years of cumulative exploit potential.
What feels like small technical debt widens the opportunity window for major exploitation.
Trust and everyday behavior
There is also a human side to these tools.
Advertisement
Email, documents, browsers, and archives feel like infrastructure. People trust them like desks and keyboards. Opening a PDF does not feel like running code. Previewing an email does not feel like execution. Extracting a file feels routine.
By the time behavior looks unusual, the initial interaction already happened in a place people rarely question. These actions occur thousands of times a day, which makes tracing a compromise back to a document, email, or user extremely difficult.
Figure 2: Secure, scalable patch management across Windows, macOS, and third-party apps, with compliance reporting and 200 forever-free endpoints.
Looking at the footprint, not just the platform
For leadership teams, the value here is perspective, not fear.
Security strategies often start with the platform layer, operating systems, networks, identity, cloud infrastructure. Those matter, but they do not tell the full story of how work actually happens.
Work happens in email clients, spreadsheets, PDFs, browsers, archive tools, and remote sessions. That is where files open, previews render, links get clicked, and data moves between people.
Advertisement
That makes them predictable.
That is why third-party patching often carries more risk weight than expected. The operating system may be tightly managed, while the tools on top quietly define real exposure.
Looking at the footprint is less about assuming weakness and more about understanding where everyday work intersects with real security concerns.
A quieter way to think about patching
Third-party patching often feels operational rather than strategic. Yet these utilities sit at the intersection of people, files, and execution.
Advertisement
They are ordinary, and that is exactly why they matter.
Not because every organization looks the same, but because they look similar enough that attackers design around that similarity.
When teams examine environments, the focus is usually infrastructure. There is also value in asking what the standard business suite looks like across endpoints, how it evolves, and how consistently it stays current.
Which tools are actually needed? Which are simply part of a default deploy? Which stay installed even when unused? Which stop getting updated because nobody notices them?
Advertisement
This is why, in practice, teams working with platforms like Action1 consistently see third-party patching deliver a greater reduction in real-world risk than many more visible security controls. Exploitation rarely hinges on a single overlooked vulnerability. It is enabled by years of accumulated drift across third-party applications that quietly fall out of date while remaining embedded in everyday workflows.
Those conditions exist long before an exploit is written or deployed. They shape the practical attack surface by defining which software actually executes, which files get opened, and which actions feel routine enough to avoid scrutiny.
Third-party software is not adjacent to the platform — it is part of how the platform operates, and it is often where exposure concentrates when everything else appears well-managed.
Action1is a founder-led company, brought to you by the original minds behind Netwrix. At the time of this writing, it is one of the fastest-growing private software companies in the US because organizations are recognizing that OS and third-party patching can no longer be treated as a secondary task.
Advertisement
Addressing modern risk requires continuous visibility into third-party software and the ability to remediate vulnerable applications across endpoints quickly and consistently. When teams evaluate modern patch management solutions, Action1 increasingly represents the option designed around that reality.
Engadget reports:
In a lengthy post on Truth Social on February 27, President Trump ordered all federal agencies to “immediately cease all use of Anthropic’s technology” following strongdisagreements between the Department of Defense and the AI company. A few hours later, the U.S. conducted a major air attack on Iran with the help of Anthropic’s AI tools, according to a report from The Wall Street Journal.
Even Trump’s post noted there would be a six-month phase-out for Anthropic’s technology (adding that Anthropic “better get their act together, and be helpful during this phase out period, or I will use the Full Power of the Presidency to make them comply, with major civil and criminal consequences to follow.”)
Fish are popular animals to keep as pets, and for good reason. They’re relatively low maintenance, relaxing to watch, and have a high aesthetic appeal. But for all their upsides, they aren’t quite as companionable as a dog or a cat. Although some fish can do limited walking or flying, these aren’t generally kept as pets and would still need considerable help navigating the terrestrial world. To that end, [Everything is Hacked] built a fish tank that allows his fish to move around on their own. We presume he’s heard the old joke about two fish in a tank. One says, “Do you know how to drive this thing?”
The first prototype of this “fish tank” is actually built on a tracked vehicle with differential steering, on which the fish tank would sit. But after building a basic, driveable machine, the realities of fish ownership set in. The fish with the smallest tank needs is a betta fish, but even that sort of fish needs much more space than would easily fit on a robotics platform. So [Everything is Hacked] set up a complete ecosystem for his new pet, making the passenger vehicle a secondary tank.
The new fish’s name is [Carrot], named after the carrots that [Everything is Hacked] used to test the computer vision system that would track the fish’s movements and use them to control the mobile fish tank. There was some configuration needed to ensure that when this feisty fish swam in circles, the tank didn’t spin around uncontrollably, but eventually he was able to get it working in an “arena” where [Carrot] could drive towards some favorite items he might like to interact with. Mostly, though, he drove his tank to investigate the other fish in the area.
The ultimate goal was for [Everything is Hacked] to take his fish on a walk, though, so he set about training [Carrot] to respond to visual cues and swim towards them. In theory, this would have allowed him to be followed by his fish tank, but a test at a local grocery did not go as smoothly as hoped. Still, it’s an interesting project that pushes the boundaries of pet ownership much like other fish-driving projects we’ve seen.
The analysis company’s Commodities at Sea monitoring also recorded outbound oil and product flows averaging about 20.4 million barrels per day in February to date, slightly below January levels—evidence that geopolitical tension alone can slow shipments before any physical disruption occurs.
“Hormuz risk is not only about closure but also fleet productivity. If Iran escalates by seizing tankers or using drones to threaten commercial traffic, voyage times and possibly costs for Middle East oil exports would further increase,” S&P Global CERA analysts said.
Multiple shipping companies have already reported that they are avoiding the Strait of Hormuz and expect delays and rescheduling of shipments.
What Would Closing the Strait Mean?
There is no alternative export system at comparable scale. Saudi Arabia and the UAE operate bypass pipelines, but these cover only a portion of Gulf flows, while Iraq, Kuwait, and Qatar lack meaningful alternatives.
Advertisement
If the strait formally closed, most oil exports from the Gulf would be cut off from the world almost immediately. Even if Saudi Arabia and the UAE pushed their alternative pipelines to the limit, analysts say about two-thirds of Gulf exports would still be stuck.
LNG markets would also be hit. Qatar, the world’s largest exporter of liquefied natural gas—a super-cooled form of natural gas shipped by tanker—depends almost entirely on the Strait of Hormuz to export its fuel.
If the route were blocked, Asian buyers could lose their key suppliers within days. Asian economies such as Japan, South Korea, China, and India depend heavily on imported LNG to generate electricity.
Getting oil from elsewhere, like the Atlantic, would mean longer shipping times and higher costs, potentially pushing prices even higher.
If that happens, the effects would likely reach global consumers quickly: higher gas prices, more expensive airline tickets, and rising transport costs that feed into the price of food and goods.
Financial markets typically react even before physical shortages appear, with oil futures rising, transport-sector equities weakening, and currencies of major energy exporters strengthening as traders price in the risk of disruption.
Strategic petroleum reserves could moderate the shock, but releases take time and cannot fully substitute for Gulf crude grades.
Advertisement
Inside the Gulf, stopping exports would quickly strain government finances. Countries such as Iraq, Kuwait, and Qatar rely heavily on oil revenues to fund public spending. If shipments halted, storage facilities could fill rapidly, forcing producers to cut output and lose income.
Shipping effects would extend beyond oil. Tanker rerouting, insurance repricing, and naval risk zones tend to raise freight rates across bulk commodities and container shipping, impacting worldwide logistics.
On a warm fall afternoon at Walt Disney Studios in Burbank, California, a gentle breeze blows through the meticulously landscaped trees lining the walkways. A ray of sunshine hits the famed Team Disney building, where 19-foot-tall stone carvings of the seven dwarfs of Snow White fame hold up the roof.
The renowned sculptural architecture is a nod to the film that helped build the Disney empire. And just across the lot, inside Disney’s Main Street Cinema, the entertainment giant is exploring ways to preserve that legacy with the help of technology, such as artificial intelligence. Four startups are gathered in the theater to present their technology to a crowd of executives and media attendees. One startup, Animaj, is demonstrating how it uses AI to accelerate the animating process.
Brightly colored, blobby figures prance and bound across a wide screen in front of me, characters from a children’s YouTube series called Pocoyo. Animaj — selected by Disney as one of its 2025 cohort of startups to finance, platform and mentor via the Disney Accelerator Program — is now using human artists and AI to produce these shorts, allowing it to bring the series to screens quickly.
Advertisement
“Thanks to this tool, it takes less than five weeks to produce a 5-minute-long episode, whereas it used to take five months,” Animaj CEO and co-founder Sixte de Vauplane tells me, speaking in front of the company’s demo space after the presentation.
CNET
That dramatic acceleration of a traditionally painstaking process flows directly from the rapid advances in generative AI in the past several years, and those advances aren’t just for professionals: AI-powered video-generating tools surged into the mainstream in 2025. Google’s Veo 3 and OpenAI’s Sora 2 now allow anyone to create a cartoon animation from the comfort of their phone, without any sketching experience or even artistic inclination required. The use of generative AI is something that Hollywood is fighting to keep at bay, lest it take jobs away from human artists.
But Animaj says that its technology doesn’t replace animators. It simply makes their jobs less tedious. An animator will still be sketching out each of the main poses, and then AI will be used to fill in all the in-between movements of the character that move them from A to Z. And even then, the company says, an animator is in control of tweaking those AI-generated movements.
It’s an interesting perspective when I think about the building right across from me, which houses hundreds of Disney animators. Will they see AI the same way? Disney confirmed it will soon introduce its partnership with Animaj, with the two companies in discussions around how to potentially use this AI system in animation across Disney Branded Television and Disney Television Studios.
Advertisement
“The plan is to announce something in the coming months,” says David Min, vice president of Disney Innovation.
Keeping artists centered with AI tools
Hand sketches become instant 3D animations.
Animaj
Animators will control the AI feature as another part of their digital toolkit, according to de Vauplane. The storyboarding process will remain the same as it is with more traditional computer-generated imagery, he says. The AI tool will just “bring the idea to life much faster.”
Advertisement
“The artist is in control. For us, it’s super important because we know that AI can be seen as a threat for the artist,” de Vauplane says. “We want to show that there is another way to use AI in a very ethical way.”
I reached out to the Animation Guild for comment and am still awaiting a response. But late last year, after four months of bargaining, the union representing animators was unable to include many AI safety provisions in its contract. They would not be able to avoid using AI tools if required by a job, for instance, or to opt out of having their work used to train those AI tools.
But artistic expression has a long history of evolving with technology.
Animators moved on from watercolor hand sketches — used to animate Snow White and the Seven Dwarfs and Sleeping Beauty in the 1930s and 1950s, respectively — to CGI for movies like The Little Mermaid and Aladdin in the 1980s and 1990s. It transitioned into 3D CGI with the release of Tangled and Frozen in the 2010s. Each technological innovation has sped up the animation process. So is AI simply another tool in the modern CGI toolkit, especially if it preserves the key elements of an animator’s workflow?
Advertisement
To maintain the “creator-first approach” that centers human artists — a hallmark of last century’s Walt and Roy Disney partnership — Min says that Disney looked into “pretty much all of the AI companies.”
“We looked at thousands of companies, all big and small, and what Animaj does well is that the artist is really driving the process,” he says, adding that you don’t really see this in video-generating AI apps like Sora and Veo, which read your text prompts and spit out (usually nonsensical) videos. “This is the artist drawing the key frames from A to Z, and then allowing things to be filled in in between. That’s why we selected Animaj.”
Expediting the animation process
The “motion in-betweening” feature from Animaj lets artists input main character positions, with the AI model filling in the blanks of what gets the character from standing to sitting position.
Advertisement
Animaj
Animaj’s AI tool is used to expedite the animation process. Trained only on images from the show in question, and working within the parameters of an animator’s real-time sketches, the AI tool predicts the character’s next moves — and the animator corrects it when it goes awry. This can save a lot of time: hours, weeks, months, depending on the type of animation and show being worked on.
Min says it takes much longer to make an animated series than many people understand.
“It can be like a year before you can even get a pilot of something to test out. With Animaj, they can do it in 30% of the time,” Min says. We’re standing in front of Disney’s Stage 1 building, amid a throng of Disney cast members, startup reps and other tech execs and enthusiasts. “The future of animation is a big, broad statement, but definitely this is where the future of animation is going and trending.”
Like so many media companies in the age of streaming, Disney needs to produce high-quality content at a faster rate to keep up with audience demand. Animaj also uses AI to collect data to understand what themes are trending or resonating with online audiences, and then animate episodes quickly to meet those interests while they’re current and popular.
Advertisement
Because its animation process moves so rapidly, Min says, Animaj can also test new ideas much faster.
“Not only do they have the content production AI to actually help build the animated shorts faster,” Min says, “but then they’re using AI to also read the analytics on what’s going on with the viewing of the video that can then help inform the storytelling as well.”
How does AI animation work?
Outside, sitting under a tree in the California sunshine, a Pocoyo animator sketches a character on a screen with a 3D model popping up on a screen beside it. I watch as he uses a stylus to make slight adjustments to arm and leg movements generated by the AI.
Advertisement
An animator sketches Pocoyo characters while the AI model instantly generates the sketches into 3D versions.
Corinne Reichert/CNET
“Our proprietary animation tool allows the artist, Joe sitting here, to draw a sketch and to control the animation just based on the sketch,” says Antoine Lhermitte, Animaj’s chief technology officer, as we watch the artist work. It’s a big time-saver, he adds.
Blog posts by Animaj detail how it uses AI to bring sketches to animated life, while still retaining the unique art style of an animation. The company used four seasons of Pocoyo to build a database of more than 300,000 poses, using both sketches and their corresponding 3D poses for each character that the AI model could learn from. Artists were also asked to produce more sketches of the characters to be used in the next season.
Artists can input into a 3D pose-modeling program various positions of the character, for instance, standing and then sitting. The AI model would then fill in the blanks of what gets the character from standing to sitting position, something Animaj calls “motion in-betweening.”
Advertisement
Working with the AI model, the artist makes corrections to any of the AI-generated animations, like shifting an arm or a leg to where it should be. The time savings with not having to hand-draw every single pose that comes with a character’s actions means animators can “concentrate more on refining the style and flow of scenes rather than starting from scratch with each new pose,” Animaj says.
As a result, the artists are freed up from repetitive tasks to spend more time on the creative side. At the same time, it’s enabling those artists to use an AI tool that is matched up with their working style, and not one producing text prompt-based AI slop, like all those horrific animations invading YouTube or social media, where the characters’ features change in every frame or have three tails and 17 fingers.
“We know how frustrating it can be when you use third-party AI models and you prompt something, it creates something so different than what you have in mind,” de Vauplane says. “Here, it creates something, generates something you can easily tweak…something which is fully consistent with the brand DNA.”
Preserving that Disney DNA is critical as the entertainment giant seeks to uphold its 100-year legacy while keeping pace with modern technology. As the seven dwarfs sang in the 1937 classic Snow White, which established Disney as an animation powerhouse, “Heigh ho, heigh ho, it’s off to work we go.” For tomorrow’s animators, it’s off to work with the help of AI.
More recently, Iran has been a regular adversary in cyberspace—and while it hasn’t demonstrated quite the acuity of Russia or China, Iran is “good at finding ways to maximize the impact of their capabilities,” says Jeff Greene, the former executive assistant director of cybersecurity at CISA. Iran, in particular, famously was responsible for a series of distributed-denial-of-service attacks on Wall Street institutions that worried financial markets, and its 2012 attack on Saudi Aramco and Qatar’s Rasgas marked some of the earliest destructive infrastructure cyberattacks.
Today, surely, Iran is weighing which of these tools, networks, and operatives it might press into a response—and where, exactly, that response might come. Given its history of terror campaigns and cyberattacks, there’s no reason to think that Iran’s retaliatory options are limited to missiles alone—or even to the Middle East at all.
Which leads to the biggest known unknown of all:
5. How does this end? There’s an apocryphal story about a 1970s conversation between Henry Kissinger and a Chinese leader—it’s told variously as either Mao-Tse Tung or Zhou Enlai. Asked about the legacy of the French revolution, the Chinese leader quipped, “Too soon to tell.” The story almost surely didn’t happen, but it’s useful in speaking to a larger truth particularly in societies as old as the 2,500-year-old Persian empire: History has a long tail.
Advertisement
As much as Trump (and the world) might hope that democracy breaks out in Iran this spring, the CIA’s official assessment in February was that if Khamenei was killed, he would be likely replaced with hardline figures from the Islamic Revolutionary Guard Corps. And indeed, the fact that Iran’s retaliatory strikes against other targets in the Middle East continued throughout Saturday, even after the death of many senior regime officials—including, purportedly, the defense minister—belied the hope that the government was close to collapse.
The post-World War II history of Iran has surely hinged on three moments and its intersections with American foreign policy—the 1953 CIA coup, the 1979 revolution that removed the shah, and now the 2026 US attacks that have killed its supreme leader. In his recent bestselling book King of Kings, on the fall of the shah, longtime foreign correspondent Scott Anderson writes of 1979, “If one were to make a list of that small handful of revolutions that spurred change on a truly global scale in the modern era, that caused a paradigm shift in the way the world works, to the American, French, and Russian Revolutions might be added the Iranian.”
It is hard not to think today that we are living through a moment equally important in ways that we cannot yet fathom or imagine—and that we should be especially wary of any premature celebration or declarations of success given just how far-reaching Iran’s past turmoils have been.
Defense Secretary Pete Hegseth has repeatedly bragged about how he sees the military and Trump administration’s foreign policy as sending a message to America’s adversaries: “F-A-F-O,” playing off the vulgar colloquialism. Now, though, it’s the US doing the “F-A” portion in the skies over Iran—and the long arc of Iran’s history tells us that we’re a long, long way from the “F-O” part where we understand the consequences.
Advertisement
Let us know what you think about this article. Submit a letter to the editor atmail@wired.com.
The number of ransomware victims paying threat actors has dropped to 28% last year, an all-time low, despite a significant increase in the number of claimed attacks.
A downward payment trend has been observed for the past four consecutive years by the blockchain intelligence platform Chainalysis.
At the moment, the total of on-chain ransomware payments in 2025 stands at $820 million, but the company notes that “the 2025 total is likely to approach or exceed $900 million as we attribute more events and payments.”
Chainalysis reports a relative stability in the total number of payments, despite a 50% increase of ransomware attacks year-over-year.
Advertisement
In 2024, the payment rate recorded by Chainalysis was more than double, at 62.8%, while in 2022, it was at 78.9%.
Data leak events (bars) and payment rate (line) Source: Chainalysis
Data from Chainalysis also aligns with previous reports by Coveware, which showed a steady decline in victim payment rates throughout 2025.
According to the blockchain company, some of the factors that influenced the ransomware economy include improved incident response, regulatory scrutiny, international law enforcement actions, and market fragmentation.
Current Chainalysis data shows that while aggregate revenue from ransomware activity declined, the median ransom payment rose significantly, up 368% from $12,738 in 2024 to $59,556 in 2025.
This indicates that ransomware victims pay larger amounts for the hope that cybercriminals will delete the stolen data and not sell it to other threat actors or trade it.
Advertisement
Payment amounts graph Source: Chainalysis
In 2025, the analysts observed 85 active extortion groups, far higher compared to previous years, when the ransomware space was dominated by a small number of threat groups and RaaS platforms.
A few high-impact incidents Chainalysis highlights in its report include the attack at Jaguar Land Rover, which inflicted an estimated $2.5 billion in damages, the Marks & Spencer breach by the Scattered Spider threat group, and the DaVita Inc. ransomware breach that exposed 2.7 million patient records.
For another year, the most targeted country was the United States, followed by Canada, Germany, and the U.K., showing threat actors’ preference for concentrating their efforts in developed economies.
Targeted countries and industries Source: Chainalysis
Initial access brokers (IABs), hackers who sell access to compromised endpoints to ransomware operators, reportedly made $14 million in 2025, roughly the same as last year. This is only 1.7% of the total ransomware revenue last year, though initial access is a key enabler.
Analysis shows that spikes in IAB payment inflows are followed by increases in ransomware payments and victim leak posts roughly 30 days later, suggesting IAB activity can act as a leading indicator.
The average price for network access declined from approximately $1,427 in Q1 2023 to just $439 in Q1 2026, indicating that automation, AI-assisted tooling, and oversupply from info-stealer logs have shaped the industry.
Advertisement
Chainalysis says that although ransom payments declined last year, the scale, sophistication, and real-world impact of ransomware attacks continued to grow, impacting organizations of all sizes and backgrounds globally.
The researchers believe ransomware is going through a phase of adaptation, rather than losing the fight, evolving tactics to extract more value from an ever-decreasing number of consenting victims.
Malware is getting smarter. The Red Report 2026 reveals how new threats use math to detect sandboxes and hide in plain sight.
Download our analysis of 1.1 million malicious samples to uncover the top 10 techniques and see if your security stack is blinded.
While Honor has already made plenty of product announcements, with tablets, foldables and more, its most interesting device at MWC 2026 is the Robot Phone — and maybe the humanoid robot that came alongside it.
After briefly showing off a model at CES, Honor isn’t quite ready to launch its Robot Phone. However, we got more specs, tech demos and a closer look following the company’s MWC press event in Barcelona. The Robot Phone is currently set to launch later this year.
Image by Mat Smith for Engadget
Honor has put a lot of effort into ensuring its camera gimbal is highly mobile, to the point of creating a tiny personal robot that is, dare I say, adorable? The Robot Phone’s pop-up camera can cock its head, shake to say no, nod to agree, and even “flip” – or at least rotate 360 degrees. According to Honor’s presentation, it can even bop along to songs. A spokesperson told me that it’s got five songs in its repertoire, so it’s not clear whether they’re programmed for these kind of demos, or will be a feature of the final retail device.
Another demo here at MWC showed how you could make the Robot Phone “sleep” by covering its gimbal eye, though it’s odd that the camera is still exposed rather than folded away. My main concern with the Robot Phone is the robustness and durability of its robotic mechanisms. We’ve lived through several waves of smartphones that attempted much simpler mechanical camera functions and the threat of dust or heavy-handed users can’t be ignored.
Advertisement
Image by Mat Smith for Engadget
The company says it’s taken what it learned from foldables, regarding high-performance materials and simulation accuracy, and applied it to shrinking the camera module. On stage, Honor CEO James Li revealed what he calls the industry’s smallest micro motor, much smaller than a 1-euro coin and, he added, 70 percent smaller than existing micro motors.
As this component has been reduced substantially, the Robot Phone’s gimbal will be the industry’s smallest 4-degrees-of-freedom gimbal system. That’s a spec – we finally got a spec! It’ll also offer three-axis stabilization in this tiny camera package, with the primary camera using a 200-megapixel sensor.
The fold-away panel that the primary camera tucks into also reveals more typical cameras, so you’re not forced to use the gimbal if you don’t need it. Still, that’s one very thick camera unit:
Image by Mat Smith for Engadget
Honor has already started building out camera modes and features, with a Super Steady Video mode that enhances stability while swinging the Robot Phone around to capture video. AI Object Tracking will apparently intelligently follow subjects, while AI SpinShot supports intelligent 90-degree and 180-degree rotational movement for more cinematic transitions. We’ve seen these sorts of pre-programmed movements and functions in full-size phone gimbals and action cams. If Honor can nail it in such a tiny form, it’ll be impressive.
Advertisement
Other specifications during Honor’s press event were sparse, although the company announced a collaboration with ARRI Image Science to bring its cinematic smarts to the Robot Phone’s gimbal camera.
In a press release, Honor’s Li said the collaboration would bring ARRI’s “cinematic standards and professional workflows” into mobile imaging. It’s apparently the first time elements of ARRI Image Science are being integrated into a consumer device. Dr. Benedikt von Lindeiner, VP at ARRI, said the goal is to bring a true cinematic aesthetic, such as “natural color, gentle highlight roll-off, and a sense of depth,” to shooting with an Honor smartphone.
Image by Mat Smith
Honor also made a humanoid robot companion for its Robot Phone. The bot took to the stage alongside the Robot Phone, danced alongside human dancers, did a backflip and shook hands with CEO James Li. It didn’t say a thing, but fortunately, during some on-the-rails banter between the robot, Robot Phone and Honor’s CEO, the Robot Phone was particularly chatty.
Like the many humanoid robots we’ve reported on and seen in person, Honor hopes to put it to work in both industrial and domestic settings, pitching it as a central part of the company’s multi-million-dollar push into AI. For now, it’s being called Honor Robot.
MWC 2026 officially gets underway on March 2 and will continue through March 5, but the announcements are already coming ahead of its start. We can always count on the annual tech event to bring tons of new phones, laptops and tablets, and we’re expecting to see some robots and other gadgets too — plus plenty of AI news, of course. In addition to the announcements, MWC is our chance to get hands-on time with some of the most interesting new devices, like the Xiaomi 17 Ultra and Honor’s Robot Phone.
Engadget’s Mat Smith is on the ground in Barcelona, and we’ll be updating this story as the week goes on to keep you in the loop on everything that caught our attention. Keep checking back here for the latest MWC news.
Honor
The Robot Phone. (Image by Mat Smith for Engadget)
Honor teased its Robot Phone this past fall and we just finally got a proper look at it at MWC. And it’s pretty freakin’ cute. The phone is equipped with a camera that’s mounted on a highly mobile 4-degrees-of-freedom gimbal, which tucks away into a compartment on the back when it’s not in use (making for a pretty beefy camera bump). In a demo at MWC, the camera, which behaves like a little robot head, bobbed along to music and showed off some of its gesture skills, like cocking its “head” and nodding in agreement.
Honor didn’t reveal too much spec-wise, but the company says the primary camera uses a 200-megapixel sensor. The gimbal will offer three-axis stabilization, which will be coupled with camera modes such as Super Steady Video and AI Object Tracking. The Robot Phone isn’t quite ready for release at the moment, but the company says it will launch later this year.
Advertisement
Be sure to check out Mat Smith’s writeup on the Robot Phone for a more in-depth look.
Honor’s humanoid robot. (Image by Mat Smith for Engadget) (Image by Mat Smith)
It’s not a humanoid robot reveal without some backflips and a choreographed dance performance. Honor introduced its robot at MWC with all the spectacle we’ve come to expect (though the bot didn’t do any talking). It’s simply called the Honor Robot, and the company has plans for it to be used in both industrial and domestic settings.
Honor Magic V6 (Honor)
The Robot Phone isn’t the only phone Honor showed off at MWC. The company also announced its Magic V6 smartphone, which it says is the thinnest phone in its category, measuring 8.75mm folded and 4.0mm open in the white colorway. The other three colors — black, gold and red — are slightly thicker, at 9mm folded and 4.1mm open.
Not too much has changed from the V5, though, which only came out in August 2025. It does however have the Snapdragon 8 Elite Gen 5, with 16GB RAM and 512 GB storage. As for the cameras, there are two 50-megapixel lenses and a 64-megapixel telephoto, plus a 20-megapixel f/2.2 selfie lens on the cover and internal display.
Advertisement
The international version of the Magic V6 will have a 6660mAh battery with 25 percent silicon content, while the version sold only in China will boast a battery with a rated capacity of more than 7000mAh and 32 percent silicon content. Honor hasn’t yet shared details about pricing and availability.
Honor MagicPad (Honor)
Ahead of MWC, Honor also announced what it claims is the thinnest Android tablet in the world: the 4.8mm thick MagicPad 4. We’re expecting to hear more about this at Honor’s press conference on Sunday, but so far we know it features a 12.3-inch 165Hz OLED display and weighs just 450g. It comes with up to 16GB of RAM and 512GB of storage, and is powered by Qualcomm’s Snapdragon 8 Gen 5 chipset. The thinness doesn’t count the camera bump, Honor notes. The MagicPad 4 has 13MP rear and 9MP front cameras. It also boasts spatial audio, with eight speakers.
Just as the display is slightly smaller than the previous MagicPad, the MagicPad 4 has a smaller battery at 10100 mAh. It comes with a 66W fast charger. The MagicPad 4 will run Honor’s MagicOS 10. We don’t yet know how much it will cost, but we’ll update this after Honor’s press conference (where we’re also expecting to see the company’s robot) with any new details.
Xiaomi x Leica
Mat Smith for Engadget
Xiaomi kicked off MWC this year by announcing the global launch of its 17 Ultra smartphone, which debuted first in China back in December. It’s unclear if the phone will ever come to the US, but it’s now rolling out in Europe. Xiaomi teamed up again with Leica to make a photography-focused smartphone, and the 17 Ultra sports a 1-inch 50-megapixel camera sensor with a f/1.67 lens, a telephoto setup with a 200MP 1/1.4-inch sensor, and a 50MP ultrawide camera. There’s also a manual zoom ring around the camera.
Advertisement
Check out our hands on for our first impressions of what it’s like shooting with the Xiaomi 17 Ultra. And there’s more to it than just the camera. The 17 Ultra has a 6.9-inch OLED 120 Hz display that peaks at 3,500 nits of brightness, and a 6000mAh silicon-carbon battery. The Xiaomi 17 Ultra starts at £1,299 (roughly $1,750).
Leica also announced a new phone made in partnership with Xiaomi at MWC. It looks a whole lot like Xiaomi’s 17 Ultra, but isn’t the 17 Ultra, exactly.
Leica Leitzphone by Xiaomi hands-on at MWC 2026 (Image by Mat Smith for Engadget)
Like the 17 Ultra, Leica’s Leitzphone by Xiaomi has a 1-inch camera sensor and physical controls for zoom and other settings, using a mechanical ring around the camera unit. It features a Leica-designed intuitive camera interface with the option to show just the essentials when you’re shooting, hiding all the modes and labels. There’s a monochrome shooting mode and Leica filters.
The Leica branding is splashed all over it in design and wallpapers, but it’s otherwise pretty similar to the 17 Ultra, with the same specs. Like the 17 Ultra, it has a Snapdragon 8 Elite Gen 5 chip and a 6.9-inch 120Hz display. This one’s priced at €1,999 (roughly $2,362).
Advertisement
The Xiaomi Pad 8 Pro (Xiaomi)
In addition to the 17 Ultra, Xiaomi announced two new tablets at MWC this year: the Xiaomi Pad 8 and Xiaomi Pad 8 Pro. There’s nothing revolutionary here, but they’re lightweight and thin, with both being 5.75mm thick and weighing 485g, and have a 9200mAh battery. The Pro model is powered by a Snapdragon 8 Elite chip, while the regular Pad 8 uses the Snapdragon 8s Gen 4 chipset.
Xiaomi also unveiled a new 5000mAh powerbank, the UltraThin Magnetic Power Bank 5000 15W. The 6mm thick power bank comes in three colors with an aluminum alloy shell: orange, silver and charcoal gray. Along with that, the company introduced the Xiaomi Tag, its own take on the Bluetooth item tracker. The Xiaomi Tag has a built-in hanging loop so it can be attached directly to a keyring, and the company says it will work with both Apple Find My and Google’s Find Hub for Android.
Tecno
Tecno
We can always expect to see some wild phone concepts at MWC, and this year we’re starting with one from Tecno. The company unveiled a modular concept smartphone design that can be as thin as 4.9mm in its base configuration. There’d be 10 modules to choose from based on the announcement, including various camera lenses, a gaming attachment and a power bank, relying on magnets to keep it all together — or Modular Magnetic Interconnection Technology, as Tecno is calling it.
A number of Apple Store locations in the United Arab Emirates have temporarily closed, in line with government recommendations as Middle East tensions rise.
Apple Al Maryah Island
Joint strikes on Iran by the United States and Israel has led to an escalation of tensions in the Middle East, including the death of Iranian leader Ayatollah Ali Khamenei. Following the initial strikes and retaliation by Iran, as well as the threat of future incidents, Apple has moved to close its stores in the United Arab Emirates. The UAE’s Ministry of Human Resources and Emiratisation has made a recommendation to private sector companies in the country. The advisement seeks to minimize the number of workers in open areas, excluding anyone in essential roles requiring physical attendance. Continue Reading on AppleInsider | Discuss on our Forums
In a lengthy post on Truth Social on February 27, President Trump ordered all federal agencies to “immediately cease all use of Anthropic’s technology” following strong disagreements between the Department of Defense and the AI company. A few hours later, the US conducted a major air attack on Iran with the help of Anthropic’s AI tools, according to a report from The Wall Street Journal.
The president noted in his post that there would be a “six-month phase-out period for agencies like the Department of War who are using Anthropic’s products,” so federal agencies are still expected to eventually move away from using Claude or other Anthropic tech. It’s also not the first time that the US used Anthropic’s AI for a major military operation, as the WSJpreviously reported that Claude was used in the capture of the now-removed Venezuelan president Nicolás Maduro.
Moving forward, the Department of Defense may begin transitioning towards other AI options, especially after reaching deals with both xAI and OpenAI to use their models within the federal agency’s network. However, the WSJ reported that it would take months to replace Anthropic’s Claude with other AI models.