M3AAWG is a proud sponsor of Interisle’s Cybercrime Supply Chain 2026 Report. Learn more via Interisle’s official press release and full report.
Interisle's Cybercrime Supply Chain 2026 report is now available. After analyzing more than 30 million unique cybercrime events, Interisle’s report offers valuable insight into the cybercrime epidemic and the resources enabling it. On the eve of M3AAWG’s 68th General Meeting in Paris and during Cybercrime Awareness Month, the findings reinforce the need for further industry collaboration and coordination to disrupt the cybercrime supply chain.
Cybercrime is growing, and so is its reach
This year’s report shows a 17% increase in malware, phishing, and spam attacks, and a dramatic 56% year-over-year rise in phishing attacks. Behind these numbers, cybercriminals around the world continue expanding their reach and deepening their pockets with the rapid advancements of technology and the anonymity of cryptocurrency, with little to no concern for the human impact of their crimes.
Easy Access, Widespread Abuse
One particularly concerning finding in the report includes the growing exploitation of free hosting and subdomain service usage. With more than 1.1 million malicious subdomains identified, we see a 67% increase compared to last year. As cybercriminals continue to exploit these services and perform these abuses at scale, the report calls on the industry to expand efforts around identity verification, automated abuse detection, and collaboration to disrupt access to cybercrime resources.
From Recommendations to Real-World Action
This year’s report calls for greater accountability and stronger safeguards across the industry, with key recommendations including improved identity verification, automated abuse detection, and more effective mechanisms for identifying and stopping malicious activity.
Interisle's key recommendations include:
- Verify Customer Registration Information
- Implement robust identity verification/certification requirements for parties wishing to register domain names in bulk.
- Deploy automated systems to detect suspicious registration requests and use, deny cybercriminals access to resources, and shut down instances of abuse more quickly.
- Create “Trusted Reporter” programs across industry.
- Adopt proactive measures to identify and block automated user account creation.
- Require corrective action by service providers that are shown to consistently and disproportionately supply cybercriminals with the resources used in attacks.
It is important to note that no single organization can implement all these recommendations independently. Whether you’re a registrar, security researcher, hosting provider, or messaging provider, each organization has varying levels of visibility into criminal activity, and a unique role to play in disrupting the cybercrime supply chain.
The Cybercriminals Aren't Working Alone, Neither Should We.
Now more than ever, it is important that we keep anti-abuse discussions flowing and problem-solving as a community. As we prepare to meet for M3AAWG68 in Paris next week, these findings provide a timely reminder of the importance of our work. M3AAWG remains committed to bringing industry experts together to exchange expertise, develop best practices, and identify actionable strategies to disrupt the infrastructure enabling cybercrime.
Identifying abuse is only one piece of the puzzle. By working together across the industry, we can take meaningful action to disrupt the resources cybercriminals rely on and make it increasingly difficult and costly for them to continue operating.
Readers are encouraged to read Interisle's Cybercrime Supply Chain 2026 report, share it among your network, and identify actionable strategies to prevent access to the infrastructure enabling cybercrime.