Bridewell

China hosted 42.3% of all tracked Cobalt Strike infrastructure, the US hosted 18.9%, and Hong Kong hosted 15.8%.

Across 2025, 7,918 victim postings were observed on ransomware group data-leak sites (DLS) across 129 distinct threat actors sourced from ransomware.

China remained the second largest adversary infrastructure hosting location at 13.55%, down from 17.57% the previous year.

70% of financial organisations expressed worry over state-linked cyber actors such as Russia.

44% of financial institutions cited complying with cyber security regulations as the single most pressing challenge.

33% of financial organisations increasingly use AI for automated incident response.

Cobalt Strike accounted for 38.4% of all OST output (3,944 of 10,272 tracked OST instances), maintaining its position as the primary adversary framework.

Germany increased to 8.74%, becoming the third largest adversary infrastructure hosting location and overtaking both Hong Kong (7.22%) and the Netherlands (6.51%).

WhiteSnake Stealer was the most widely observed infostealer family, accounting for 31.6% of all tracked output, followed by RedLine at 23.9%, Rhadamanthys at 17.1%, and StealC at 6.9%.

The most prevalent malware families observed in 2025 are Cobalt Strike, Sliver, Metasploit, Burp, PlugX, SuperShell C2, Havoc, Panda C2, Brute Ratel, and ShadowPad.

In 2025, 27.89% of all adversary infrastructure tracked was hosted in the US, an increase from 23.63% in 2024.

89% of financial organisations expressed concern about AI-powered phishing attacks.

Fear of China-backed threats has fallen sharply from 80% to 57% among financial organisations.

It takes financial organisations nearly 16 hours to respond to supply chain attacks on average.

35% of financial organisations view cloud security as a high challenge.

69% of financial organisation expressed worry over state-linked cyber actors such as Iran.

31% of financial organisations are turning to regional security partnerships to address the skills gap.

More than a fifth of financial organisations will be boosting budgets by up to 10%

39% of financial organisations view remote and hybrid work practices as key security concerns.

81% of financial organisations express confidence in their ability to secure IT infrastructure.

39% of financial organisations are turning to reskilling to address the skills gap.

39% of financial institutions reported heightened concerns around data privacy.

The average response time to ransomware attacks is 6.71 hours among financial institutions. Last year's average response time to ransomware attacks was 6.62 hours.

More than half (52%) of financial organisations plan to outsource to address the skills gap.

22% of financial organisations increasingly use AI for threat intelligence.

63% of financial services firms will increase cyber security investment over the next year.

30% of financial organisations view incident detection capabilities as a high challenge.

37% of financial institutions reported heightened concerns around the security of critical assets.