Gregory Flatt

Drive-by ransomware: This type of attack doesn’t start with malware; it doesn’t start with a zero-day; it starts with a phone call.

The GTG-1002 campaign, disclosed publicly at the end of last year, has become a reference in discussions about whether cyberattacks are beginning to cross the line from automated to autonomous. It is frequently cited as the first “AI-orchestrated” cyber-espionage operation. While that label is controversial, the campaign does represent a genuine inflection point in how offensive cyber operations are being conducted.

In 2026, cybersecurity risks for small and medium businesses will focus less on new technologies and more on how attackers are changing their tactics. These changes significantly impact organizations with small security teams, limited oversight, and increasing use of cloud services and automation.