Major Cyber Threat Trends and Shifts in 2025
Cybersecurity research throughout 2025 revealed significant changes in the threat landscape, with both SentinelLABS and KrakenLabs reporting a marked evolution in attacker tactics and the professionalization of cybercrime. Threat actors increasingly leveraged artificial intelligence to automate attacks, generate convincing social engineering content, and bypass security controls, making AI a practical tool for both sophisticated and commodity threats. The exploitation of legitimate infrastructure, such as free-tier publishing platforms and commercial AI APIs, became commonplace, while adversaries also began monitoring defender intelligence-sharing platforms to stay ahead of detection. The rise of crimeware-as-a-service (CaaS) further industrialized cybercrime, enabling a broader range of actors to access advanced capabilities and monetize initial access to corporate networks.
Geopolitical tensions and the convergence of organized cybercrime with emerging technologies accelerated the pace and scale of attacks, with threat actors blending ideological motives with financially driven ransomware and extortion campaigns. Traditional carding fraud declined due to regulatory and law enforcement efforts, but attackers shifted focus to abusing trusted third-party platforms and exploiting identity and access management weaknesses. These developments defined the cyber threat environment in 2025 and set the stage for ongoing risks into 2026, as organizations faced increasingly sophisticated and industrialized adversaries.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
9 events from the most recent confirmed update back to the earliest known activity.
SharePoint zero-day CVE-2025-53770 is exploited
SentinelLABS identified exploitation of the SharePoint zero-day CVE-2025-53770 as a notable 2025 incident. The case stood out among a year otherwise marked more by operational scaling than by novel exploitation.
Nobitex cryptocurrency platform is attacked
KrakenLabs cited a 2025 attack on Nobitex as a notable cryptocurrency-related incident. The event reflected the continued targeting of digital-asset platforms amid the convergence of cybercrime and geopolitics.
China's use of private cybersecurity firms for state surveillance is exposed
SentinelLABS said 2025 reporting revealed deep integration between Chinese private cybersecurity firms and state surveillance efforts. The exposure added detail on how commercial entities supported government cyber and monitoring objectives.
Large phishing campaigns leverage thousands of subdomains
SentinelLABS documented 2025 phishing operations that used thousands of subdomains at scale. The campaigns showed how attackers were weaponizing legitimate infrastructure to industrialize social-engineering activity.
Threat actors use LLMs to generate unique malware
During 2025, SentinelLABS observed adversaries using large language models to help create unique malware. The report characterized AI as an operational accelerator that increased speed and variation rather than fundamentally changing tradecraft.
PXA Stealer and Katz Stealer campaigns show advanced automation
SentinelLABS reported that 2025 information-stealer campaigns involving PXA Stealer and Katz Stealer demonstrated increasingly automated operations and monetization. The activity reflected the broader professionalization of cybercrime.
Salesforce breaches occur via social engineering
KrakenLabs identified 2025 data breaches involving Salesforce environments compromised through social-engineering tactics. The incidents underscored growing attacker focus on identity abuse and third-party SaaS access.
Black Basta chat logs are leaked
In 2025, leaked Black Basta chat logs exposed internal communications and operational details of the ransomware group. The leak provided new insight into the group's human dynamics and business practices.
Belsen Group mass-exploits Fortinet FortiGate devices
KrakenLabs highlighted a 2025 campaign in which the Belsen Group conducted large-scale exploitation of Fortinet FortiGate devices. The activity illustrated the continued industrialization of access-focused cybercrime.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
2 references tracked. Mallory keeps watching after this page renders.
See the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Major Cybersecurity Incidents and Threat Trends of 2025
The cybersecurity landscape in 2025 was marked by a series of high-profile breaches, advanced persistent threat (APT) campaigns, and evolving tactics by both cybercriminals and state-linked actors. Notable incidents included the PornHub data breach, where the ShinyHunters group exfiltrated and extorted sensitive user activity data, and the Knownsec leak, which exposed the espionage tools and global targeting strategies of a major Chinese cybersecurity firm. Supply-chain attacks continued to proliferate, with attackers compromising widely used software libraries and cloud services, impacting thousands of organizations and individuals. The year also saw a surge in sophisticated social engineering campaigns, such as ClickFix attacks, and a significant number of APT operations targeting government and military institutions, particularly in South and East Asia. Cloud service outages, such as the prolonged AWS disruption, highlighted the dependency of IoT and critical infrastructure on cloud reliability, causing widespread operational impacts. The threat actor ecosystem became more industrialized, leveraging AI, ransomware-as-a-service, and multi-stage attacks to increase scale and efficiency. Cryptocurrency platforms suffered major heists, and new vulnerabilities like MongoBleed were rapidly exploited in the wild. The cumulative effect of these incidents underscored the need for robust supply-chain security, improved cloud resilience, and enhanced detection and response capabilities against both opportunistic and targeted attacks.
Mar 21, 2026
Major Cybersecurity Trends and Incidents in 2025
The cybersecurity landscape in 2025 was marked by a series of high-impact incidents and evolving threat trends, with identity-driven intrusions, large-scale breaches, and record-breaking DDoS attacks dominating the year. Notable breaches at organizations such as Ingram Micro, Conduent, and Kettering Health resulted in hundreds of millions of dollars in losses, with regulatory filings and industry analyses highlighting the significant operational and financial impacts. Attackers increasingly exploited known vulnerabilities, with the CISA Known Exploited Vulnerabilities (KEV) catalog serving as a critical indicator of attacker intent, and legacy flaws resurfacing as major risk factors. The year also saw a strategic shift in security operations, with organizations prioritizing risk-based decision-making over exhaustive control coverage, and automation and real-time intelligence becoming essential for defense. DDoS attacks reached unprecedented scales, with Cloudflare reporting attacks peaking at 31 Tbps and the emergence of massive botnets like Aisuru. These attacks were often used as smokescreens for deeper intrusions, and the growing sophistication and speed of DDoS campaigns rendered traditional scrubbing-center defenses increasingly obsolete. Geopolitical tensions further shaped the threat landscape, with critical infrastructure and sectors such as gaming and gambling frequently targeted. The industry’s response emphasized the need for adaptive, globally distributed mitigation strategies and highlighted the importance of governance, consent management, and just-in-time administration to separate resilient organizations from those more vulnerable to systemic risk.
Mar 21, 2026
Major Cyberattack and Malware Trends in 2025
Cybersecurity threats in 2025 were marked by a surge in sophisticated attacks targeting both enterprises and critical infrastructure. Notable incidents included the exploitation of a zero-day vulnerability (`CVE-2025-61882`) in Oracle E-Business Suite by the Clop ransomware group, leading to data theft and extortion campaigns against multiple organizations. Ransomware activity overall increased, with Akira and Qilin dominating the ransomware-as-a-service market, and new strains like Warlock and HybridPetya introducing advanced evasion and destructive capabilities. The year also saw a significant rise in software supply chain attacks and the emergence of AI-powered malware such as PromptLock, which can generate malicious scripts dynamically. State-sponsored campaigns remained a persistent threat, exemplified by the BRICKSTORM malware attributed to Chinese actors, which targeted VMware and Windows systems in government and IT sectors. Data breaches, such as the API compromise at 700Credit affecting over 5.6 million individuals, highlighted ongoing risks in third-party integrations and API security. Malware-as-a-service platforms like CloudEyE (GuLoader) surged in prevalence, facilitating the distribution of infostealers and ransomware. The threat landscape was further complicated by the proliferation of EDR killers and the rapid evolution of Android NFC-based threats, underscoring the need for robust detection and response strategies across all platforms.
Mar 21, 2026