Loading story…
Malware activity in 2025 demonstrated significant evolution, with non-ransomware malware playing a critical role in cyber intrusions across enterprise and industrial environments. Notable malware families such as QakBot, IcedID, Emotet, TrickBot, AsyncRAT, RedLine Stealer, and Lumma Stealer were widely used for initial access, credential theft, persistence, and post-compromise control, often operating undetected for extended periods. These malware strains enabled attackers to harvest sensitive data and maintain long-term footholds, supporting broader attack campaigns and facilitating the distribution of secondary payloads.
Industrial automation systems also faced persistent threats, with Kaspersky reporting that 20.1% of ICS computers encountered blocked malicious objects in Q3 2025, involving over 11,000 different malware families. The biometrics, engineering, and manufacturing sectors were particularly affected, with notable increases in malware activity in East Asia due to the spread of malicious scripts within OT infrastructures. The diversity and sophistication of malware targeting both enterprise IT and industrial OT environments underscore the ongoing challenge of defending against evolving cyber threats.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Throughout 2025, smaller organizations were disproportionately affected by malware due to limited security resources, while macOS-targeted and cross-platform malware also grew notably. Attackers increasingly abused legitimate tools and targeted browser and cloud authentication data to evade detection and maintain post-compromise control.
Across 2025, malware activity was characterized by persistent, low-noise campaigns using families such as QakBot, IcedID, Emotet, TrickBot, and RedLine Stealer for initial access, credential theft, and persistence. Email remained the primary delivery vector, while attackers increasingly monetized stolen access through infostealers and Malware-as-a-Service ecosystems.
In Q3 2025, a large-scale phishing campaign exploiting CVE-2017-11882 contributed to increased detection of malicious documents in South America. Kaspersky also observed rising spyware and ransomware infection rates in industrial environments during the quarter.
In Q3 2025, Kaspersky reported a significant increase in malicious activity in East Asia, driven in part by the spread of malicious scripts affecting engineering organizations and ICS integrators. The report also noted continued targeting of the biometrics sector and broad malware diversity across industrial environments.
During Q3 2025, Kaspersky ICS CERT recorded a slight decrease in the share of industrial control system computers on which malicious objects were blocked, reaching 20.1%, the lowest level noted in the report. Internet access, email clients, and removable media remained the main infection sources in ICS environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cybersecurity threats in 2025 were marked by a surge in sophisticated attacks targeting both enterprises and critical infrastructure. Notable incidents included the exploitation of a zero-day vulnerability (`CVE-2025-61882`) in Oracle E-Business Suite by the Clop ransomware group, leading to data theft and extortion campaigns against multiple organizations. Ransomware activity overall increased, with Akira and Qilin dominating the ransomware-as-a-service market, and new strains like Warlock and HybridPetya introducing advanced evasion and destructive capabilities. The year also saw a significant rise in software supply chain attacks and the emergence of AI-powered malware such as PromptLock, which can generate malicious scripts dynamically. State-sponsored campaigns remained a persistent threat, exemplified by the BRICKSTORM malware attributed to Chinese actors, which targeted VMware and Windows systems in government and IT sectors. Data breaches, such as the API compromise at 700Credit affecting over 5.6 million individuals, highlighted ongoing risks in third-party integrations and API security. Malware-as-a-service platforms like CloudEyE (GuLoader) surged in prevalence, facilitating the distribution of infostealers and ransomware. The threat landscape was further complicated by the proliferation of EDR killers and the rapid evolution of Android NFC-based threats, underscoring the need for robust detection and response strategies across all platforms.
Jun 29, 2026
Cybersecurity agencies and researchers reported a surge in sophisticated cybercrime operations and malware campaigns in December 2025. Notable law enforcement actions included the takedown of major cybercriminal forums such as Cracked and Nulled, and the disruption of ransomware networks like Phobos/8Base, as highlighted in SOCRadar's review of top law enforcement operations. Concurrently, threat intelligence sources documented a rise in ransomware attacks, with LockBit 5.0 targeting 25 companies globally, and agencies intensifying pressure on pro-Russian hacktivist groups. The month also saw a significant malware incident in New Zealand, where the national cyber security agency warned 26,000 citizens about infections by Lumma Stealer, a credential-harvesting malware. Technical research revealed the continued evolution of information-stealing malware, such as Stealc and Phantom Stealer, which leverage new delivery methods including Discord-hosted payloads and fake software updates. The Mirai botnet family demonstrated renewed activity, with new variants like Broadside and Jackskid exploiting IoT vulnerabilities and targeting sectors such as maritime logistics. Reports also underscored the growing threat of browser-based attacks, with critical vulnerabilities being disclosed throughout the year, and the increasing use of social engineering tactics to bypass security controls. These developments reflect a rapidly shifting threat landscape, with attackers adopting advanced techniques and law enforcement responding with coordinated global operations.
Jun 29, 2026
Cybersecurity research throughout 2025 revealed significant changes in the threat landscape, with both SentinelLABS and KrakenLabs reporting a marked evolution in attacker tactics and the professionalization of cybercrime. Threat actors increasingly leveraged artificial intelligence to automate attacks, generate convincing social engineering content, and bypass security controls, making AI a practical tool for both sophisticated and commodity threats. The exploitation of legitimate infrastructure, such as free-tier publishing platforms and commercial AI APIs, became commonplace, while adversaries also began monitoring defender intelligence-sharing platforms to stay ahead of detection. The rise of crimeware-as-a-service (CaaS) further industrialized cybercrime, enabling a broader range of actors to access advanced capabilities and monetize initial access to corporate networks. Geopolitical tensions and the convergence of organized cybercrime with emerging technologies accelerated the pace and scale of attacks, with threat actors blending ideological motives with financially driven ransomware and extortion campaigns. Traditional carding fraud declined due to regulatory and law enforcement efforts, but attackers shifted focus to abusing trusted third-party platforms and exploiting identity and access management weaknesses. These developments defined the cyber threat environment in 2025 and set the stage for ongoing risks into 2026, as organizations faced increasingly sophisticated and industrialized adversaries.
Jun 29, 2026