Picus RedReport 2025 Overview

Keypoints

• Annual cybersecurity reports by major vendors typically include an executive summary, detailed analysis of prevalent attack techniques, threat landscape insights, and recommendations for security improvements, structured to inform organizations of emerging risks.
• These reports analyze large datasets of malware samples, often millions, to identify the most frequently observed tactics, techniques, and procedures (TTPs) used by cyber adversaries over the past year.
• Key statistics highlight a significant rise in credential theft malware, with a threefold increase from 8% in 2023 to 25% in 2024, indicating the growing sophistication and focus on credential-related attacks.
• Recurring themes include the dominance of the top ten MITRE ATT&CK techniques, which account for over 93% of malicious actions, underscoring the attackers’ reliance on process injection, scripting exploits, credential theft, and encrypted communication channels.
• Threat trends show attackers deploying multi-stage, persistent, and stealthy operations, such as the fictional “SneakThief,” which encapsulates real-world tactics like process injection, data exfiltration via encrypted channels, and long-term network infiltration.
• Reports emphasize that defending against these advanced threats requires continuous validation of security controls, adoption of behavior-based detection, and proactive threat hunting rather than traditional signature-based methods.
• Vendors recommend comprehensive defense strategies including multi-stage incident response, credential management, encryption inspection, and network segmentation to mitigate the most common and dangerous attack vectors.
• Analyzing threat actor groups like APTs from Russia, China, and North Korea reveals ongoing geopolitical espionage campaigns, emphasizing the importance of threat intelligence and deception technologies in modern cybersecurity defenses.
• The reports also note minimal current use of AI-driven malware techniques, suggesting AI mainly enhances attacker productivity rather than serving as a primary attack vector.
• Overall, these reports aim to shape a proactive, informed security posture by pinpointing the most effective defensive measures against the evolving cyber threat landscape.