AI-driven attacks, zero-days and cybercrime syndicates top Secureframe threat report – News

A new report out today from compliance automation platform provider Secureframe Inc. details the most dangerous cyberthreats of 2025 so far, with artificial intelligence-enhanced attacks, zero-day exploits and organized cybercrime syndicates emerging as top risks.

The report identifies eight major threat vectors affecting organizations today. Ransomware, phishing, insider threats and credential compromise continue to cause widespread disruption. Notably, ransomware attacks targeting industrial operators were found to have surged 46% in the first quarter of this year, while data breach costs in healthcare now average $5.3 million, 25% higher than in any other industry.

Among the multiple ransomware attacks this year, the report highlights a ransomware case earlier this year that forced 158-year-old U.K. company KNP Logistics Group Ltd. into bankruptcy after a single compromised password allowed attackers to cripple its systems.

The report states that emerging threats driven by technological advances are posing even more complex challenges than in previous years. Not surprisingly, generative AI leads the list and is noted to be being weaponized at scale to allow attackers to craft convincing phishing emails, deepfakes and polymorphic malware that can evade detection.

Supply chain vulnerabilities also get a look-in, with attackers found to be increasingly infiltrating enterprise environments via third-party vendors. In one highlighted case, an attack in May linked to a compromised SAP SuccessFactors provider impacted companies across healthcare, construction and consumer goods.

Zero-day or unpatched exploits were also found to be being turned around faster than ever, such as in the case of a critical Microsoft SharePoint flaw — designated CVE-2025-53770 — that was actively exploited in the wild before a patch was issued. As noted in coverage on July 20, the exploit, dubbed “ToolShell,” affected on-premises versions of SharePoint Server 2016, 2019 and the Subscription Edition. It stemmed from insecure deserialization, allowing unauthenticated remote code execution and giving attackers the ability to to take control of servers without any credentials.

On the nation-state front, actors were found to be ramping up so-called advanced persistent threats using stealth tactics such as fileless malware and credential harvesting to target defense, energy and telecom sectors. Groups such as APT33 and APT39 have intensified operations globally, according to the report.

Secureframe outlines a 10-step defense playbook aligned with National Institute of Standards and Technology Cybersecurity Framework version 2.0 and the International Organization for Standardization’s information security standard ISO/IEC 27001 to help organizations strengthen their security posture.

Recommendations in the report include enforcing multifactor authentication, implementing robust vendor risk assessments and running cybersecurity tabletop exercises to simulate breach scenarios. The report also urges organizations to adopt continuous monitoring, zero-trust frameworks and AI-driven anomaly detection to counter evolving threats.

Image: News/Reve