Report by IBM
IBM X-Force 2025 Threat Intelligence Index
Key Findings
Manufacturing is the #1-targeted industry by attacks for the fourth year in a row.
The number of infostealers delivered via phishing emails per week increased by 84% year-over-year.
Ransomware made up 28% of malware cases in 2024.
The global average cost of a data breach hit a record $4.88 million in 2024.
Ransomware comprises nearly one-third (28%) of malware incident response cases and 11% of security cases.
Of all the malware cases, 28% involved ransomware, followed by backdoors and webshells, at 20% and 13% respectively.
Manufacturing organisations experienced 24% of attacks involving data theft.
The top initial access vector observed in 2024 was a tie between exploitation of public facing applications and use of valid account credentials, both representing 30% of X-Force incidence response engagements.
Manufacturing organisations experienced 29% of attacks involving extortion.
Analysis of dark web data reveals a 25% increase in ransomware activity year-over-year.
In 2024, the top impact experienced by victim organisations was credential harvesting, occurring in 28% of incidents.
Manufacturing had the highest number of ransomware cases in 2024.
The share of successful phishing compromises has declined steadily from 46% in 2022 to 29% in 2023 to now just 25% of all incidents remediated by X-Force in 2024.
Identity-based attacks made up 30% of total intrusions for the second year in a row.
Data theft was observed in 18% of incidents.
The number of vulnerabilities has increased rapidly over the past eight years and grown threefold.
25% of attacks exploit public-facing applications.
Only 24% of generative AI projects are secured.
Nearly a quarter of all vulnerabilities in the IBM X-Force Vulnerability Database have an associated weaponized exploit.
Nearly one in three attacks observed by X-Force used valid accounts.
60% of the top 10 vulnerabilities had been actively exploited or had a publicly available exploit from less than two weeks after disclosure to a zero day.
30% of the incidents X-Force responded to in 2024 involved the exploitation of public-facing applications.
Early data from 2025 suggests an even greater increase of 180% of weekly infostealer volume compared to 2023.
The deployment of malware was the most observed action on objectives, making up 42% of cases.
The Asia-Pacific (APAC) region experienced the largest share of security incidents in 2024 at 34%.
X-Force observed a decline in ransomware incidents overall for the third year.
4 out of top 10 vulnerabilities most mentioned on the dark web are linked to sophisticated threat actors.
Analysis of dark web data reveals listings of infostealer advertisements increased 12% in 2024 over the previous year.
Of all PDFs used in malicious spam, 42% used obfuscated URLs, 28% hid their URLs in PDF streams, and 7% were delivered in an encrypted form along with a password.
Malicious ZIP and RAR attachments in phishing emails dropped by 70% and 45% respectively
There was a 12% year-over-year increase of infostealer credentials for sale on the dark web.
The percentage of companies integrating AI into at least one business function has dramatically increased to 72% in 2024, up 55% from the previous year.
Credentials or data were stolen in nearly half of all cyberattacks.
Extortion following a ransom demand occurred in 12% of cases.