CrowdStrike released its 2025 Global Threat Report, exposing the growing aggression of China’s cyber operations, a surge in GenAI-powered social engineering and nation-state vulnerability research and exploitation, and a sharp increase in malware-free, identity-based attacks. The report reveals that China-nexus adversaries escalated state-sponsored cyber operations by 150 per cent, with targeted attacks in financial services, media, manufacturing and industrial sectors soaring up to 300 per cent.
At the same time, adversaries worldwide are weaponising AI-generated deception, exploiting stolen credentials and increasingly executing cross-domain attacks—exploiting gaps across endpoint, cloud and identity—to bypass security controls and operate undetected in the shadows. The shift to malware-free intrusions that exploit trusted access, combined with record-shattering breakout times, leaves defenders little room for error. To stop modern attacks, security teams need to eliminate visibility gaps, detect adversary movement in real-time and stop attacks before they escalate—because once they’re inside, it’s already too late.
CrowdStrike Global Threat Report Highlights
Tracking more than 250 named adversaries and 140 emerging activity clusters, CrowdStrike’s latest research reveals:
- China’s cyber espionage grows more aggressive: CrowdStrike identified seven new China-nexus adversaries in 2024, fueling a 150 per cent surge in espionage attacks, with critical industries seeing up to a 300 per cent spike in targeted attacks.
- GenAI supercharges social engineering: AI-driven phishing and impersonation tactics fueled a 442 per cent increase in voice phishing (vishing) between H1 and H2 2024. Sophisticated eCrime groups like CURLY SPIDER, CHATTY SPIDER and PLUMP SPIDER leveraged social engineering to steal credentials, establish remote sessions and evade detection.
- Iran utilises GenAI for vulnerability research and exploitation: In 2024, Iran-nexus actors increasingly explored GenAI for vulnerability research, exploit development and patching domestic networks, aligning with government-led AI initiatives.
- From breaking in to logging in – Surge in malware-free attacks: 79 per cent of attacks to gain initial access are now malware-free while access broker advertisements surged 50 per cent YoY. Adversaries exploited compromised credentials to infiltrate systems as legitimate users, moving laterally undetected with hands-on keyboard activities.
- Insider threats continue to rise: DPRK-nexus adversary FAMOUS CHOLLIMA was behind 304 incidents uncovered in 2024. 40 per cent involved insider threat operations, with adversaries operating under the guise of legitimate employment to gain system access and carry out malicious activity.
- Breakout time hits record speed: The average eCrime breakout time dropped to 48 minutes, with the fastest recorded at 51 seconds—leaving defenders little time to react.
- Cloud environments under siege: New and unattributed cloud intrusions increased by 26 per cent YoY. Valid account abuse is the primary initial access tactic, accounting for 35 per cent of cloud incidents in H1 2024.
- Unpatched vulnerabilities remain a key target: 52 per cent of vulnerabilities observed were related to initial access, reinforcing the critical need to secure entry points before adversaries establish persistence.
“China’s increasingly aggressive cyber espionage, combined with the rapid weaponisation of AI-powered deception, is forcing organisations to rethink their approach to security,” said Adam Meyers, head of counter-adversary operations at CrowdStrike. “Adversaries exploit identity gaps, leverage social engineering and move across domains undetected—rendering legacy defenses ineffective. Stopping breaches requires a unified platform powered by real-time intelligence and threat hunting, correlating identity, cloud and endpoint activity to eliminate the blind spots where adversaries hide.”
CrowdStrike pioneered adversary-driven cybersecurity through the CrowdStrike Falcon cybersecurity platform, which delivers AI-powered protection, real-time threat intelligence and expert threat hunting to secure identity, cloud and endpoint as the gold standard in cybersecurity. Leveraging innovative behavioral AI and machine learning trained on industry-leading threat intelligence and trillions of security events, CrowdStrike delivers real-time protection against advanced threats, providing comprehensive visibility and protection across the entire attack lifecycle.
Discussion about this post