Report by Huntress
Huntress 2025 Cyber Threat Report
Key Findings
Manufacturing saw 17% of incidents linked to malware-based attacks in 2024.
Play, Dharma/Crysis and Akira executed some of the fastest attacks, often within six hours, in 2024.
Ransomware gangs took an average of 18 actions before executing their final attack in 2024.
Over 75% of remote access incidents utilized Remote Access Trojans (RATs) such as AsyncRAT and Jupyter.
The average time-to-ransom (TTR) was just under 17 hours in 2024.
Nearly 30% of phishing attacks impersonated e-signature services in 2024, with Microsoft and DocuSign being the most copied brands.
Akira and RansomHub typically deployed ransomware in around six hours.
71% of incidents involved data exfiltration before deploying ransomware in 2024.
Scripts made up 22% of detected attacks, using PowerShell, VBScript, and JavaScript to perform stealthy, efficient attacks
Nearly 24% of incidents involved infostealers designed to extract sensitive credentials, financial data, and other private information.
In government, info-stealing malware was the top threat, making up 21% of breaches in 2024.
75% of remote access incidents involved RATs in 2024, with AsyncRAT, Jupyter and NetSupport RAT accounting for a third of all cases.
Healthcare and education accounted for 38% of all cyber incidents in 2024.
Malicious scripts were used in 22% and 24% of attacks in healthcare and education respectively, and 19% of incidents in technology firms in 2024.