Reading view

It takes two: The 2025 Sophos Active Adversary Report

2 April 2025 at 05:01

The dawn of our fifth year deepens our understanding of the enemies at the gate, and some tensions inside it; plus, an anniversary gift from us to you

A sidebar (callout box) that says: Rather than read this edition of the Active Adversary Report in PDF format? Click here to reach a (non-gated) PDF version of this page.

A sidebar (callout) box that says: IR and MDR: What’s the difference? Though both of the datasets we use are derived from response activity, there is a critical difference in how they are generated. IR data comes from customers who come to us without MDR services already in place; they may call us when they suspect an incident is underway, or they may simply be referred by their insurance company or otherwise familiar with Sophos. MDR data comes from current managed customers (so, customers with at least some Sophos monitoring and logging services in place) who need incident response to neutralize active threats and remediate the actions of attackers; in almost all cases, we initiate notice to them that something bad is happening.

A line chart showing, for the five years 2020-24, attack types observed by Sophos responders. A rise in network breaches and decline in ransomware incidents in the past year is discussed in text. The other nine attack types seen in our reports are a pile of spaghetti at the bottom of the graphic, with none of those root causes represented in more than 8 percent of cases in any given year.

Three tables showing, for MDR + IR in 2024, the root causes of investigated incidents. It is divided into IR-only, MDR-only, and combined data. As covered in text, compromised credentials were the leading root cause for both IR and MDR cases.

Four stacked bar charts showing, for the years 2021-24, the ascribed root causes of incidents. The stacks add up to 100 percent for each year. The findings are discussed in the report text.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the artifact data category. It is divided into IR-only, MDR-only, and combined data. There is a 60 percent overlap between MDR and IR artifact findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings in the LOLBin data category. It is divided into IR-only, MDR-only, and combined data. There is a 70 percent overlap between MDR and IR LOLBin findings.

Three tables showing, for MDR + IR in 2024, the top 10 findings not covered in the Artifact or LOLBin data categories. It is divided into IR-only, MDR-only, and combined data. There is an 80 percent overlap between MDR and IR Other findings.

A table showing ransomware attributions seen in MDR + IR data for 1H24, 2H24, and for the whole year. Chart shows only ransomware families seen in more than two percent of cases; conclusions re data are discussed in text

A bar chart showing remote ransomware incidents by month from September 2021 through December 2024; a sharp rise starting in the second half of 2023 is visible

A table with three lists showing attack impact in IR data 2020-23, in IR + MDR data 2024, and for the full five-year time period, by percentage

A world map showing the nations and other locations listed in the table immediately below

This Is Where Asteroid 2024 YR4 Could Strike

Science Latest

By:Jorge Garay

13 February 2025 at 04:00

There is a 2 percent chance that seven years from now, “the city destroyer” will hit Earth with the force of an 8-megaton nuclear weapon. Here are its possible impact points.