What are 2025 Threat Intelligence Trends and Defenses

TL;DR

Ransomware payments have dropped for the third consecutive year, with a 35 percent decrease in payments. Phishing incidents are down 50 percent, and persistent malware has decreased due in part to stronger endpoint detection and response tools. However credential theft remains the main entry point, and info stealers and attacker in the middle tactics are on the rise, with AI evolving as a new attack surface.

Transcript

Information is power. The more you know, the more you can do. And that is especially true in the world of cybersecurity. The more, you know about what hackers are doing, the better job you can in building defenses. That's why the annual IBM X-Force Threat Intelligence Index Report is so important. In this report, IBM security researchers published ... Read More

Key Insights

• Ransomware payments are down for the third year in a row, and high-profile takedowns by law enforcement are contributing to this trend.
• Phishing attacks have decreased by roughly half, signaling improved user education or security tooling, though threats still persist in other attack vectors.
• Persistent malware occurrences have dropped, likely due to better IT security investments such as endpoint detection and response capabilities.
• Credential theft remains the number one entry point, accounting for up to 30 percent of breaches according to the report.
• Info stealer campaigns are rising, with an 84 percent increase in the types of attacks that steal credentials and data.
• Dark web findings show all top ten vulnerabilities had publicly available exploits, indicating real and accessible threats.
• Access as a service and attacker in the middle tactics illustrate how adversaries monetize credentials and intercept login paths.
• Artificial intelligence is identified as a growing attack surface once production adoption crosses a critical threshold, requiring secure data, models, and usage.

Questions & Answers

Q: How can organizations defend against credential theft as the primary entry point?

Credential theft is the main entry point for breaches, so organizations should prioritize multi-factor authentication and consider passkeys to reduce the risk of phishing and credential harvesting. Implementing centralized secrets management helps protect passwords, API keys, and certificates, while auditing and rotating credentials limits exposure. These steps collectively raise the barrier for attackers and reduce successful credential use.

Q: What shifts are happening in ransomware attack strategies according to the index?

Ransomware attackers are increasingly focusing on data theft and extortion rather than pure encryption, and they may use the stolen data themselves or threaten public disclosure if victims do not pay. This shift changes the risk model from restoring systems to protecting and controlling sensitive data, highlighting the need for data loss prevention, access controls, and rapid incident response.

Q: Why is AI considered a new attack surface and how should it be secured?

AI is flagged as a growing attack surface as production adoption increases. Securing AI requires protecting the data used to train models, securing the models themselves, and securing how the model's outputs are used. Organizations should implement end-to-end controls along the data model usage pipeline to prevent data leakage, model manipulation, and misuse of AI-enabled capabilities.

Q: What do the terms access as a service and attacker in the middle imply for defenders?

Access as a service shows how adversaries can rent or leverage infrastructure to steal credentials or facilitate intrusions, while attacker in the middle refers to intercepting credentials during login paths. Defenders should monitor for anomalous credential use, defend login paths with strong authentication, and segment networks to limit credential reuse across environments.

Q: What did the report reveal about dark web vulnerabilities and exploits?

The report found that among the top ten vulnerabilities discussed on the dark web, all had publicly available exploits, meaning threats are real and readily exploitable. This underscores the need for timely patching, vulnerability management, and active monitoring of dark web chatter to anticipate and mitigate exploit campaigns.

Q: What was the scale of the notable data breach and the ransomware payout mentioned?

One notable incident involved over one million sensitive records exposed via a popular AI chatbot, including user chat histories and API keys, illustrating data exposure risks in AI services. The report also cites a healthcare breach where a ransomware as a service operation led to a 22 million ransom payment before attackers were cut out of the deal, highlighting issues of trust and governance in RaaS models.

Q: What are the three main defensive areas recommended in the talk?

The recommendations focus on credential protection, reducing data and identity sprawl, and securing AI environments. Specific actions include using passkeys to replace passwords, deploying secrets management to control sensitive information, and treating AI as a development pipeline with security at data, model, and usage stages to mitigate evolving threats.

Q: How does the report describe the impact of law enforcement on ransomware trends?

Law enforcement actions have helped reduce ransomware activity by disrupting high profile rings, contributing to lower payments and improved overall threat posture. This indicates that coordinated takedowns can disrupt attacker infrastructure and deter future operations, reinforcing the value of cross sector collaboration and robust threat intelligence in reducing cybercrime.

Summary & Key Takeaways

• The report tracks changes in ransomware, phishing, and malware, highlighting improvements in defense and persistence issues. The analysis notes that attackers are shifting to data theft and publicization rather than encryption, and emphasizes the rising role of AI in future attacks. It also warns about new threat surfaces and the ongoing importance of credential protection and data management.

• The findings point to law enforcement action reducing ransomware activity and the emergence of services like access as a service and ransomware as a service, which alter attacker economics and risk.

• The recommendations center on credential protection, minimizing data sprawl, centralizing secrets management, and securing AI data, models, and usage throughout the development pipeline.