Report by CrowdStrike
CrowdStrike 2025 Threat Hunting Report
Key Findings
eCrime activity represented 73% of total interactive intrusions.
FAMOUS CHOLLIMA infiltrated over 320 companies in the last 12 months, representing a 220% year-over-year increase.
Nation-state activity in the telecom sector rose by 130%, driven by adversaries like GLACIAL PANDA.
Voice phishing (vishing) is on track to double last year’s volume by the end of 2025.
Cloud intrusions increased by 136% in the first half of 2025 compared to all of 2024.
The government sector experienced a 71% year-over-year increase in overall interactive intrusions and a 185% year-over-year increase in targeted intrusion activity.
SCATTERED SPIDER moved from initial access to encryption by deploying ransomware in under 24 hours in one observed case
Interactive intrusions increased 27% year-over-year.
81% of interactive (hands-on-keyboard) intrusions were malware-free.
CrowdStrike OverWatch observed a 40% year-over-year increase in intrusions by suspected cloud-conscious China-nexus actors.