Report by CrowdStrike
CrowdStrike 2025 Threat Hunting Report
Key Findings
SCATTERED SPIDER moved from initial access to encryption by deploying ransomware in under 24 hours in one observed case
CrowdStrike OverWatch observed a 40% year-over-year increase in intrusions by suspected cloud-conscious China-nexus actors.
eCrime activity represented 73% of total interactive intrusions.
FAMOUS CHOLLIMA infiltrated over 320 companies in the last 12 months, representing a 220% year-over-year increase.
Cloud intrusions increased by 136% in the first half of 2025 compared to all of 2024.
Nation-state activity in the telecom sector rose by 130%, driven by adversaries like GLACIAL PANDA.
Voice phishing (vishing) is on track to double last year’s volume by the end of 2025.
The government sector experienced a 71% year-over-year increase in overall interactive intrusions and a 185% year-over-year increase in targeted intrusion activity.
Interactive intrusions increased 27% year-over-year.
81% of interactive (hands-on-keyboard) intrusions were malware-free.