Cybereason’s TTP Briefing analyzes threat intelligence from global incident response engagements and GSOC detections to show how attackers operated during the first five months of 2025. Financial services, manufacturing, and technology/software were the most impacted industries, while business email compromise accounted for 41% of incidents, ransomware 28%, and cloud intrusion 13%. Phishing and social engineering caused 46% of initial intrusions, followed by credential abuse at 16% and exploited vulnerabilities at 14%. Although 76% of organizations had EDR, many still suffered compromise because alerts were not properly acted upon. The report maps attacks through initial access, persistence, escalation, data exposure, and end goals, highlighting tools such as AnyDesk, Webshells, Mimikatz,

Join for free to read