{"id":107597,"date":"2025-08-04T07:00:08","date_gmt":"2025-08-04T11:00:08","guid":{"rendered":"https:\/\/forescoutstage.wpengine.com\/?p=107597"},"modified":"2025-09-12T10:24:03","modified_gmt":"2025-09-12T14:24:03","slug":"midyear-threat-report-numbers-grow-in-nearly-all-the-wrong-places","status":"publish","type":"post","link":"https:\/\/www.forescout.com\/blog\/midyear-threat-report-numbers-grow-in-nearly-all-the-wrong-places\/","title":{"rendered":"Midyear Threat Report: Numbers Grow in Nearly All the Wrong Places"},"content":{"rendered":"

In the first half of 2025, Forescout Research \u2013 Vedere Labs published a wide range of blogs<\/a> and reports<\/a> analyzing some of the most prominent developments in the cybersecurity threat landscape, from vulnerabilities and ransomware campaigns to the shifting behavior of threat actors.<\/p>\n

Our data shows that cybercriminals continue to rely on familiar \u00a0IT-based tactics for malware delivery, particularly via ClickFix, which has emerged as a favorite tool for deploying both infostealers and ransomware. At the same time, ransomware operators are expanding the types of assets leveraged in their attacks<\/a>, often in an attempt to bypass EDR solutions.<\/p>\n

Network infrastructure remains a popular initial access point, with over 20% of newly exploited vulnerabilities in H1 targeting these devices. But we\u2019ve also seen attackers exploiting IP cameras and BSD servers for lateral movement and impact.<\/p>\n

Beyond traditional cybercrime, the line between hacktivists and state-sponsored actors has become increasingly blurred, especially in attacks on critical infrastructure. What was once the exclusive domain of shadowy state actor groups is now often executed by faketivist fronts. We explored this trend in depth in our April report<\/a>. Since then, escalating conflict in the Middle East has triggered renewed concern over Iranian hacktivist campaigns reaching targets in the US and Europe, \u00a0echoing the notorious CyberAv3ngers campaign of late 2023<\/a>.<\/p>\n

Our new threat briefing<\/a> reviews developments between January 1 and June 30, 2025 (2025H1) analyzing how the threat landscape has shifted compared with the same period in 2024. It includes a detailed examination of Iranian hacktivist activity and a breakdown of global attack trends.<\/p>\n

\n

Go deeper: See our interactive research page<\/a> for all the most impactful trends in 2025.<\/h4>\n<\/div>\n

Beyond the Numbers: Cybercrime Evolution, Healthcare Breaches, and Opportunistic OT Attacks<\/h2>\n

The full report<\/a> goes deeper than raw metrics, offering analysis of how threat actor behavior continues to evolve, particularly in relation to ransomware, infostealers, healthcare breaches and OT exposure.<\/p>\n

Ransomware and Infostealers<\/h3>\n

Most cybercriminal campaigns in 2025H1 involved either ransomware or infostealers. Several TTPs stood out:<\/p>\n