The Red Report 2025 focuses on the top ten most frequently observed MITRE ATT&CK techniques, presenting a roadmap for organizations to use to understand and prioritize their defenses. From process injection and credential theft to impairing defenses and data exfiltration over encrypted channels, these techniques represent the core strategies employed by todayʼs attackers to achieve their objectives.

Nuspire has witnessed shifting trends in the ransomware, dark web and exploit sections of our report. Our research revealed that ransomware extortion publications increased by 8%, Lumma Stealer fiercely reclaimed its top spot as the leading infostealer, and threat actors are focusing heavily on exploiting VPN technology.

This report looks back at the major cyber security events of 2023, offering insights and analysis to help understand and prepare for the challenges ahead. Our goal is to provide valuable information to organizations, policy makers, and cyber security professionals, helping them to build stronger defenses in an increasingly digital world. Check Point Research reports that threat actors in hacking forums have started making use of AI tools like ChatGPT, in order to create malware and attack tools such as info-stealers and encryptors.

This research report provides a comprehensive analysis of ransomware incidents and binaries recorded and gathered globally, offering insights into trends, attacker profiles, ransomware families, and the implications for cybersecurity defenses. Ransomware knows no borders and neither do the groups unleashing it. Rather than picturing these groups as a collection of individuals in hoodies, we must extend our collective imagination to fathom the international business model that delivers the end product — ransomware — to our doorsteps.

The 2024 Ransomware Risk Report reveals concerning statistics for business, IT, and security leaders. This report reveals that 74% of victims were attacked not once, but multiple times. Certain countries and industries were more likely to experience subsequent attacks. But overall, more than half the companies we surveyed were successfully breached two or more times — sometimes within the same day.

In this report, the IT-ISAC tracked 18 new ransomware groups in 2023, reflecting that financial gain continues to be one of the top motivating factors behind cyberattacks. As long as the chances of making money is high and the risk of getting caught is low, ransomware will continue. Despite government and law enforcement efforts to take down malicious infrastructure, new ransomware strains continue to emerge.

This annual report is the result of the CRU’s research and analysis of nearly half a million alerts reviewed by the ConnectWise team, which is filtered into key takeaways and action items that affect MSPs the most. The information in this report is built to help MSPs protect their SMB customers. Our goal is to help you understand and prepare for the threats you and your customers are likely to face so you can focus your time, energy, and money on defenses that will impact your customers.

In this report, cybercriminal landscape remained diverse, comprising both lone actors and criminal networks offering a wide range of expertise and capabilities. Some cybercriminals targeting the EU were based within the EU, while others preferred to operate from abroad, concealing their illicit operations and funds in third countries. The use of deepfakes is another area of concern as this is a powerful addition to the cybercriminal toolbox.

The results of the surveys affect our product strategy and go-to-market methods, and hopefully help organizations engage in deeper conversations with colleagues and teams as they continually consider modernizations to their data protection and cyber-resiliency strategies. This year’s report surveyed 1,200 respondents — comprised of CISOs (or executives with similar responsibility), security professionals, and backup administrators — whose organizations suffered at least one ransomware attack in 2023 to assess different perspectives in the united fight against ransomware.

The report is based on the findings of an independent, vendor-agnostic survey commissioned by Sophos of 5,000 IT/cybersecurity leaders across 14 countries in the Americas, EMEA, and Asia Pacific. The research reveals that investing in cyber defenses to optimize your insurance position is a double win: organizations report both easier and cheaper access to coverage as well as wider benefits such as improved protection, fewer alerts, and freeing up IT time. This finding further emphasizes the importance of considering cyber risk investments holistically, rather than as individual components.

By publishing this report, we aim to show the greater business community what has led us to this point and what can be done to reduce the risk that has resulted from this complexity. In 2023, ransomware frequency increased by 64% overall when compared to 2022, mostly driven by a 415% increase in indirect ransomware.

Our Ensign Threat Classification Matrix for identified threat groups helps organizations to prioritize their cyber defense against the territory-contextualised threats. We provide the MITRE ATT&CK heat-maps to support organizations in prioritizing their cyber defenses against specific adversary techniques and follow-through defensive actions, such as threat hunting, Red Teaming, and tuning of detection rules. We have also laid out the observed top targeted industry groups and top exploited vulnerabilities.

CISA created the KEV catalog in part because of challenges that organizations have historically faced in prioritizing vulnerabilities. In any given year, there are tens of thousands of new vulnerabilities. But according to CISA, a study of historical vulnerability data dating back to 2019 shows that less than 4% of all known vulnerabilities were being used by attackers in the wild.

This year, the report is delving deeper into the pathway to breaches in an effort to identify the most likely Action and vector groupings that lead to breaches given the current threat landscape. The cracked doorway on the cover is meant to represent the various ways attackers can make their way inside. The opening in the door shows the pattern of our combined “ways-in” percentages, and it lets out a band of light displaying a pattern of the Action vector quantities. The inner cover highlights and labels the quantities in a less abstract way.

Coalition’s 2024 Cyber Claims Report features data and case studies from organizations across the United States. Cyber risk is global, and we believe this report’s trends and risk mitigation strategies are applicable regardless of location. As an active partner in protecting organizations from digital risk, we’re proud to share these insights to help policyholders, brokers, and others in our industry stay informed about the ever-changing threat landscape.

The Professional Services sector includes a broad array of organizations. Although there are no strict criteria for considering a company to be in this sector, there is general agreement that inclusion requires specialized training and experience, and, in many cases, qualification by exam and licensing managed by either national or state authorities. Using our 5-year dataset, we have analyzed 1,500 Professional Services claims dated 2017 through 2021. Professional Services sector incidents account for 20% of all claims in the dataset.

In this special year-end edition of the WatchTower Digest, we discuss the threats we observed and investigated in 2023, and look ahead to the 2024 threat landscape. Our findings are based on SentinelOne’s Singularity telemetry across tens of millions of endpoints, operating across a diverse number of industries and global geographies.

In this year’s Annual Cyber Threat Monitor Report, we take a look back at the key events that shaped the cyber threat landscape in 2023, as well as looking ahead at the year to come, sharing insights from our Cyber Threat Intelligence team here at NCC Group. 2023 showed signs that the international community is beginning to take the threats from cyber adversaries more seriously. We saw several examples of coordinated law enforcement action against criminal groups, including key ransomware operators and individuals believed to be acting on behalf of foreign intelligence services.

Today’s cyber landscape is threatened by a multitude of malicious actors who have the tools to conduct large-scale fraud schemes, hold our money and data for ransom, and endanger our national security. Profit-driven cybercriminals and nation-state adversaries alike have the capability to paralyze entire school systems, police departments, healthcare facilities, and individual private sector entities. The FBI continues to combat this evolving cyber threat. Our strategy focuses on building strong partnerships with the private sector; removing threats from US networks; pulling back the cloak of anonymity many of these actors hide behind; and hitting cybercriminals where it hurts: their wallets, including their virtual wallets.

In year 2023, FortiGuard Labs blocked 2.4 trillion vulnerability attempts and 3 billion malware deliveries to protect its customers from cyber threats. FortiGuard Labs escalated the significant threats through the Outbreak Alert system to raise awareness. These outbreaks highlighted the various targeted and 0-day attacks, weaponized vulnerabilities, malware/ ransomware campaigns, and OT/IoT threats launched last year.

Cryptocurrency usage is growing faster than ever before. Across all cryptocurrencies tracked by Chainalysis, total transaction volume grew to $15.8 trillion in 2021, up 567% from 2020’s totals. Given that roaring adoption, it’s no surprise that more cybercriminals are using cryptocurrency. But the fact that the increase in illicit transaction volume was just 79% — nearly an order of magnitude lower than overall adoption — might be the biggest surprise of all.