Cisco Talos

Phishing was the primary means of gaining initial access in over half of Cisco Talos Incident Response engagements this quarter, up from approximately one-third of engagements last quarter.

Authentication abuse was observed in 65% of Cisco Talos Incident Response engagements this quarter, up from 35% last quarter.

Ransomware incidents made up over 20% of Cisco Talos Incident Response engagements this quarter, similar to just under 20% last quarter.

The ARToken panel exposed 80+ API endpoints for device code phishing, primary refresh token persistence, email access, BEC operations, and SharePoint exfiltration.

Threat actors maintained undetected access for approximately three days before ransomware deployment in the observed Sinobi engagement.

Vulnerable, exposed, or unpatched internet-facing infrastructure was observed in 31% of engagements this quarter, compared to 25% last quarter.

Unlimited outbound email thresholds enabled threat actors to propagate malicious activity in almost 15% of Cisco Talos Incident Response engagements this quarter.

Healthcare accounted for 17% of all engagements, while public administration and manufacturing each accounted for 14% of engagements.

Insufficient logging and visibility was observed in 42% of Cisco Talos Incident Response engagements this quarter, up from 18% last quarter.

In 2025, 35% of Talos IR phishing cases involved internal phishing.

According to their data leak site, in 2025, Qilin targeted more than 40 victims every month except January.

Device compromise attacks where attackers register their own hardware as a trusted factor, increased by 178%.

Akira and Play, ranked as second and third most prolific ransomware groups, respectively.

23% of CVEs directly impact network devices like VPN appliances, next-generation firewalls (NGFWs), load balancers, routers, and others.

25% of the top-targeted vulnerabilities impact widely used frameworks and libraries.

32% of the top-targeted vulnerabilities are at least a decade old.

The number of device registration events reported by users as fraud increased 178% from 2024 to 2025.

Technology is the top-targeted industry at 36% for MFA spray attacks.

In 2025, attackers compromised victims via phishing emails in 40% of Talos IR cases.

Nearly 40% of the top-targeted vulnerabilities impacted end- of-life (EOL) devices.

60% of the top 20 terms appearing in phishing subject lines were the same in 2024 and 2025, such as “request,” “invoice,” “payment,” “email,” “fwd,” “message,” “report,” and “meeting.”

Qilin was the most seen ransomware variant in 2025.

The popularity of the other groups in last year’s top five fell significantly this year, with LockBit 3.0 moving from first to 35th, RansomHub from second to eighth, and Hunter’s International from fifth to 28th.

Qilin affiliates take home a significant portion of their ransom payments (up to 80 - 85%), higher than typical RaaS payout structures.

In 2025, nearly a third of MFA spray attacks targeted identity and access management (IAM) applications.

The number of investigations Talos conducted into China-nexus campaigns increased nearly 75% this year compared to 2024.

Application delivery controllers (ADCs) accounted for 22% of the top 50 targeted network devices.

The majority of the 50 most-targeted network infrastructure vulnerabilities (66%) affect device-specific firmware.

January remains least active month for ransomware activity.