Attackers continue investing where defenders remain weakest. Nation-state operators are refining bespoke malware for long-term intelligence collection, ransomware groups are maximizing operational impact by targeting virtualization infrastructure.