Cyber Research Unit · H2 2025 Report

Where attackers spent H2 2025, and why it moved.

Critical Start's Cyber Research Unit reviewed 1,035 high and critical severity alerts handled by the SOC this half. Two findings anchor the report: a new industry took the top targeting spot, and the ransomware leaderboard reshuffled almost entirely. This preview covers the introduction and the two most targeted industries.

+3.70
Increase in high & critical severity alerts vs. H1 2025
18.10%
Of documented ransomware victims tied to Qilin alone
5
Industries concentrated the majority of observed adversary activity

How the Rankings Moved

H1 2025H2 2025
#2 Manufacturing
#1 Manufacturing
Climbed one spot to become the most targeted industry.
#1 Banking & Finance
#2 Banking & Finance
Fell one spot as attack volume declined 11.76%.
Manufacturing
Banking & Finance
The most targeted industry in H2 2025, up from #2.
Attack Tools & Techniques
  • Cobalt Strike
  • PowerShell
  • Metasploit
Initial Access Techniques
  • User Execution
  • Brute Force
  • Phishing
Top Threat Actors
  • Akira
  • Qilin
Top Target Countries
  • United States
  • Germany
  • United Kingdom
Malware share of attacks: 26.11%, up from 16.5% in H1.
Attackers are increasingly shifting away from traditional malicious binaries and instead abusing legitimate remote monitoring and management tools. Because these tools are digitally signed and trusted, they can bypass standard malware detection.
Jared Bronnenberg, Principal Operations Engineer, Critical Start
Down to #2 in H2 2025, with attacks declining 11.76%.
Attack Tools & Techniques
  • Cobalt Strike
  • AnyDesk
  • Mimikatz
Initial Access Techniques
  • Phishing
  • Supply Chain Compromise
  • Trusted Relationship
Top Threat Actors
  • Qilin
  • Akira
  • Incransom
  • Everest
Top Target Countries
  • United States
  • South Korea
  • United Kingdom
Credential attacks: 27.34% of confirmed cases.
Comprehensive visibility across assets, tooling, and operational activity is equally important. Unmanaged or undiscovered devices, combined with limited insight into administrative tool usage, create blind spots that adversaries can exploit.
Jared Bronnenberg, Principal SOC Engineer, Critical Start

Recent Attacks Worth Watching

Manufacturing · Critical Infrastructure
DynoWiper Hits Polish Power Operators
In late December 2025, Polish power and renewable energy operators were hit with DynoWiper, a previously undocumented data-wiping tool built to destroy files rather than extort. Investigators noted overlaps with known Sandworm tactics.
Manufacturing · Supply Chain
Apple Supplier Luxshare Suffers Data Exposure
In January 2026, a key Apple supplier had internal production and operational documents for iPhone, AirPods, and Vision Pro exposed. Researchers linked the incident to a standard data-theft-and-extortion play.
Banking & Finance · Ransomware
Marquis Software Breach Exposes 400,000+ Records
In August 2025, a ransomware-related breach at this financial software provider exposed data on over 400,000 individuals across 74 or more U.S. banks and credit unions, reached through a compromised SonicWall firewall.
Banking & Finance · Payment Fraud
Sinqia S.A. Attackers Attempt $130M in Fraud
In late August 2025, attackers used stolen IT vendor credentials to reach Brazil's PIX payment rail and attempted roughly $130 million in fraudulent transfers. The attempt was detected and stopped before funds moved.
You're looking at 2 of 5 top targeted industries. The full report covers Healthcare, Business Services, and Retail, plus five ransomware groups, MITRE timeline data, and CIRT-tested mitigation steps.
Talk to CRUGet the Full Report
See the Other Three Industries, and the Five Groups Behind Most of It
Healthcare, Business Services, and Retail round out the top five. Qilin, Akira, Incransom, Sinobi, and Play account for over 43% of documented ransomware victims this half.
Download Full H2 2025 ReportBook a Briefing with CRU
Critical Start · Cyber Research Unit · H2 2025 Cyber Threat Intelligence Report