Cyberattacks Now Start Before the Breach: Lumen Report Reveals AI-Driven Threat Infrastructure Surge in 2026

A new cybersecurity report from Lumen signals a fundamental shift in how cyberattacks are built, scaled, and executed. The findings suggest that by the time most organizations detect an intrusion, the real operation has already been underway for days or even weeks.

According to the Lumen Defender Threatscape Report 2026, attackers are no longer focused solely on breaching endpoints. Instead, they are investing heavily in building and rotating infrastructure at scale, using automation and generative AI to accelerate every phase of an attack lifecycle.

The Rise of Infrastructure-Led Cyberattacks

Modern cyber operations increasingly resemble coordinated campaigns rather than isolated incidents. Threat actors now construct sprawling networks of compromised devices, proxy systems, and command-and-control servers before launching attacks.

This shift is driven by a simple reality: traditional defenses are stronger at the endpoint. As a result, attackers are moving earlier in the kill chain, targeting internet-facing infrastructure such as routers, VPN gateways, and firewalls.

The report highlights that organizations often lack visibility into these early stages, only detecting activity once attackers have already validated access paths and staged their operations.

“Modern cyber operations look less like isolated break-ins and more like carefully staged heists,” the report notes, emphasizing that preparation now defines success in cybercrime.

Generative AI Is Accelerating Attack Speed

One of the most significant developments outlined in the report is the role of generative AI in compressing attack timelines.

Threat actors are using AI to:

• Continuously scan for exposed devices

• Validate stolen credentials at scale

• Automatically deploy and rotate infrastructure

• Optimize command-and-control communication paths

  
  

This automation enables attacks to evolve at machine speed, reducing the window defenders have to respond.

The result is a new operational tempo where infrastructure can be rebuilt almost instantly after disruption, making traditional reactive defenses less effective.

Proxy Networks and Botnets Power Modern Campaigns

The report identifies proxy networks as a foundational layer of modern cybercrime. These networks, often built from compromised home routers, IoT devices, and cloud servers, allow attackers to blend malicious activity into legitimate internet traffic.

This approach enables threat actors to:

• Evade geolocation-based controls

• Bypass Zero Trust policies

• Mask attribution by routing traffic through residential IP space

  
  

Large-scale botnets such as Kimwolf demonstrate how quickly attackers can regenerate infrastructure. After disruption, operators can spin up new command nodes and redeploy malware within hours, maintaining operational continuity.

Edge Devices Become the Primary Target

A major trend highlighted in the report is the shift from endpoints to edge devices. While endpoint detection tools are widely deployed, edge infrastructure often lacks the same level of monitoring and forensic visibility.

Attackers are exploiting this gap by targeting:

• Internet-exposed VPNs

• Firewalls and network appliances

• End-of-life or unpatched devices

  
  

This strategy allows attackers to operate “in the middle” of network traffic, intercepting credentials and maintaining persistence without triggering traditional alerts.

Cybercrime Is Now a Scalable Business Model

The report also underscores how cybercrime has evolved into a highly professionalized ecosystem. Platforms like Rhadamanthys operate as full-scale malware-as-a-service offerings, complete with subscription models, customer support, and feature updates.

This SaaS-like model lowers the barrier to entry for attackers while increasing the scale and consistency of attacks. It also enables specialization, where different groups handle infrastructure, access, and exploitation separately.

Attribution Is Getting Harder

Another key finding is the growing overlap between nation-state and criminal activity. Threat actors are increasingly sharing infrastructure, tools, and access pathways.

This convergence makes attribution more complex and shifts the focus toward behavioral analysis rather than identifying specific groups.

The New Defensive Imperative: Visibility Before Impact

Lumen’s core argument is that cybersecurity must move upstream. Instead of relying solely on indicators of compromise, organizations need to monitor infrastructure-level behavior across networks.

This includes detecting:

• Large-scale scanning activity

• Rapid infrastructure creation and rotation

• Botnet enrollment patterns

• Command-and-control communication signals

By identifying these early indicators, defenders can disrupt campaigns before they reach enterprise environments.

A Shift in the Cybersecurity Battleground

The report concludes that the frontline of cybersecurity is no longer the endpoint. It is the underlying infrastructure that powers modern attacks.

Organizations that continue to rely on reactive detection models risk falling behind as attackers move faster and operate at greater scale.

The takeaway is clear: stopping cyberattacks in 2026 requires visibility into how they are built, not just how they execute.