What cyberattacks are showing up in 2025

This is a quick follow-up to my early-2025 predictions. What are we actually seeing so far? Are this year’s attacks similar to last year’s? And were our 2025 predictions on target?

Below are the most common attack types we’re seeing right now, with notes pulled from recent reports.

Ransomware
Still very active. Several 2025 write-ups point to a sharp rise since January. Publicly known cases are in the thousands (and likely higher due to under-reporting). One clear shift: data theft + extortion (steal first, then threaten disclosure), not just encryption. You’ll also see stats like “~47% increase since the start of 2025,” “6,700+ known attacks,” and “~37% higher than 2024”—numbers you’ll find in the sources below.

Email & account takeovers (BEC/ATO)
This is what we’ve run into the most. Email account takeovers lead the way, with Microsoft 365 / Google Workspace org accounts a close second. It usually starts with weak/no MFA, reused passwords, or targeted phishing. Once an attacker owns a main mailbox, they can hit your contacts, set inbox rules, and move money. Arctic Wolf’s incident report notes ~27% of cases were Business Email Compromise (BEC) this year.

Phishing (including AI-assisted)
Phishing keeps scaling. Same flavors—spear phishing (targeted), smishing (texts), vishing (phone, sometimes AI voice). The newer angle is AI making lures cleaner and faster to produce. One 2025 write-up calls out a four-digit-percent jump in credential-phish volume since AI tools went mainstream.

Nation-state activity
Ongoing pressure on telecom/infra with “living-off-the-land” techniques and phishing for initial access. Details vary by case, but the pattern—quiet access and data collection—hasn’t really changed.

Are 2025 attacks similar to 2024?

Yes—same categories, but with the dials turned up on data-theft extortion, the quality of social engineering, and account takeovers.

Did our predictions land?

Yes. We called the AI angle getting bigger, and that’s exactly what we’re seeing—especially around credential phishing and more convincing lures.

From our side at Cenegi, real-world tickets this year have clustered around ransomware attempts, phishing/spear phishing, and email/account takeovers—with small and mid-size businesses hit most often on the phishing/ATO front.

If you want to talk through your setup or you’ve seen something odd, contact us.

Sources

• KELA Cyber — Escalating Ransomware Threats to National Security (2025): https://www.prnewswire.com/news-releases/global-ransomware-attacks-against-critical-industries-surge-34-in-2025-302589217.html

• Mayer Brown — 2025 Cyber Incident Trends: https://www.mayerbrown.com/en/insights/publications/2025/10/2025-cyber-incident-trends-what-your-business-needs-to-know

• Arctic Wolf — 2025 Threat Report: https://cybersecurity.arcticwolf.com/2025-Threat-Report-v1.html

• e-bits — The 2025 Phishing Surge: https://e-bits.com.au/the-2025-phishing-surge/

• ConnectWise — Common threats and attacks: https://www.connectwise.com/blog/common-threats-and-attacks