Threat Trends Uncovered: Emerging Attacks & Their Impact in 2025

Recorded live on April 10, 2025.

What 2024 taught us and what to expect in 2025

You cannot stop threat actors from trying. Cyber criminals will keep attempting to achieve their objectives, and no organization is immune. What you can control is whether those attempts succeed. The goal of any cybersecurity program is to detect, react to, and prevent the impact of cyber threats, not to eliminate the attempts themselves.

In this webinar, Monique Bardawil, Director of Professional Services at Field Effect, draws on 18 years in the security and intelligence community to walk through the threats that defined 2024, the techniques evolving into 2025, and the practical steps every organization can take to reduce risk.

What we saw in 2024

The threats covered here are not hypothetical. They come from two sources: incident response cases where organizations had already been breached, and active monitoring data from Field Effect's MDR clients where these same attack patterns were being attempted and blocked. The patterns hold across organizations of all sizes. Cyber criminals do not discriminate by sector or scale. They look for the fastest, easiest path to financial gain.

Threat 1: Business email compromise

Business email compromise (BEC) was one of the most consistently observed threats of 2024 and continues to be. When a threat actor compromises an email account, they typically pursue one of two objectives.

The first is credential harvesting at scale. A compromised account becomes a launching pad: the threat actor uses the victim's contact list to send phishing emails to everyone that person has ever communicated with. Because the emails appear to come from a known, trusted sender, recipients are far more likely to engage. The cycle expands as more accounts are compromised and more phishing campaigns are sent.

The second objective is financial fraud. This one is more targeted and more damaging. A threat actor gains access to an account, then quietly monitors it for roughly two weeks, watching email exchanges and identifying financial transactions in progress. Once they have enough context, they insert themselves into the conversation, impersonating the account owner and convincing the other party to redirect a payment to a fraudulent account. Finance staff and senior executives at small businesses, where one person often handles multiple functions, are common targets.

How this is evolving. MFA has long been recommended as a strong defense against account compromise, and that recommendation has not changed. But threat actors are investing in ways to get around it. The technique that emerged more prominently in 2024 is the adversary-in-the-middle attack. Rather than a generic phishing page, the victim is presented with a login page that is a near-perfect replica of their organization's actual service, complete with matching branding and logos. The victim enters their credentials, which are captured by the attacker, who then relays them to the legitimate service and prompts the victim for their MFA code. The victim enters it, the attacker intercepts it, logs in, and steals the web session cookie for ongoing access. From the victim's perspective, nothing looked wrong at any step.

A second technique gaining traction is application consent abuse. In Microsoft 365 and Google Workspace, users can grant third-party applications access to their mailboxes. Threat actors who have already gained account access are exploiting this feature to grant themselves persistent access through a seemingly legitimate application (EM client was observed being used this way in 2024). The application then has full access to the mailbox: emails, calendar, contacts, everything, even if the original compromised credentials are later changed.

What to do about it. User education remains the most important lever. Employees need to know how these attacks work and to treat unexpected emails, especially those involving financial requests or login prompts, with skepticism. From a business process perspective, a simple phone call to verify any request to change banking or payment details can catch fraud that technology misses. Technically, restricting non-administrator account permissions and requiring administrator approval for application consent grants reduces the attack surface considerably.

Threat 2: Exposed services and brute force attacks

Remote desktop protocol (RDP) and similar remote administration tools remain a persistent target. Threat actors conduct brute force attacks against internet-exposed services, systematically guessing passwords until one works. When they succeed against an administrator account, they immediately have high-privilege access to the system and the freedom to move through the network, reach critical file servers, and exfiltrate data or deploy ransomware.

One challenge that came up repeatedly in 2024 incident response cases: many organizations were not logging authentication events in sufficient detail. To confirm a brute force attack actually occurred, investigators need to see a sequence of failed attempts followed by a successful login. Without that logging, the attack path cannot be reconstructed, which limits both the investigation and the ability to improve defenses afterward.

What to do about it. IP allowlisting based on known geographic regions or trusted IP ranges limits who can attempt RDP connections in the first place. Blocking access from VPN ranges associated with high-risk locations adds another layer. On top of that, enforcing MFA and strong password requirements for all remote access makes a brute force attempt significantly harder to succeed. The principle is simple: more obstacles between the attacker and initial access means fewer successful compromises.

Threat 3: Unpatched vulnerabilities

Vulnerability management is not a new topic, but 2024 produced several high-profile examples that illustrate just how consequential delayed patching can be.

ConnectWise ScreenConnect (February 2024). This vulnerability affected organizations using ScreenConnect for remote system management and allowed threat actors to create their own administrative accounts on affected servers. For MSPs managing multiple clients through ScreenConnect, the potential blast radius was significant. What followed was a spray-and-pray attack: threat actors created accounts across a wide range of vulnerable servers, then returned to exploit the ones where those accounts had not been removed. Organizations that did not act quickly on the disclosure paid the price.

SonicWall (August 2024). An improper access control flaw in SonicWall devices allowed unauthenticated attackers to gain device access. The vulnerability was disclosed in August, but organizations were still being compromised from summer through fall because they had not patched. Multiple threat actor groups took advantage of it, and a common outcome was ransomware deployment. The takeaway: it was not just one sophisticated group exploiting a complex technique. It was opportunistic attackers going after an easy, well-advertised opening.

Fortinet (January 2024, weaponized in fall 2024). This remote code execution vulnerability was published in January, but the exploit was not widely weaponized until fall. The months between disclosure and active exploitation represent a window. Organizations that patched during that window were protected. Those that did not found themselves exposed once the attacks began.

A striking data point on vulnerability longevity: in early 2025, Cisco updated a CVE originally published in 2014. Threat actors were actively exploiting a vulnerability more than 10 years old, because it had never been patched on many systems. Old vulnerabilities do not become safe just because time has passed.

Field Effect responds to disclosed critical vulnerabilities by scanning across the MDR client fleet and alerting affected organizations through the ARO process. But the alert only helps if the organization acts on it.

What to expect in 2025

Several trends are already taking shape.

• Continued refinement of MFA bypass. As MFA becomes more universal, the adversary-in-the-middle technique and related approaches will become more polished. MFA is still worth having, but organizations should move away from SMS-based codes toward authenticator apps, and toward hardware security keys for environments with higher risk exposure.

• Cybercrime as a service. The cybercrime ecosystem has professionalized. Phishing as a service, ransomware as a service, and credential harvesting tools are available for purchase or subscription. This lowers the barrier to entry for less technically sophisticated attackers and increases the volume of attempts across the board.

• AI-enabled attacks. Threat actors are adopting the same tools the rest of us are using. AI is already being used to generate more convincing phishing emails and to accelerate attack development. Deepfakes (synthetic video and audio) are an emerging concern for social engineering at a more targeted level. Employees need to be aware that a video call or voice message is no longer automatically trustworthy.

Cybersecurity monitoring remains the foundation for detecting these threats across all of their phases. The goal is not just to catch an attack in progress but to give organizations the information they need to respond and, where possible, prevent the compromise from happening at all.

Risk reduction is a journey, not a destination

Cybersecurity is not a finite problem with a fixed solution. It is an ongoing process. Reducing risk means building resilience through four capabilities: the ability to prepare, respond, defend, and recover. The more investment that goes into the first three, the less likely recovery ever becomes necessary.

For organizations figuring out where to start, a few principles hold regardless of size or sector.

• Start with monitoring. If nothing else is in place, monitoring provides visibility. You cannot respond to something you cannot see. An MDR solution that covers network, endpoint, and cloud gives you the broadest possible view of what is happening in your environment.

• Identify risks and prioritize mitigations. Knowing where your gaps are, whether it is an exposed threat surface, outdated software, missing MFA, or undertrained users, allows you to sequence remediation in order of impact. Not every control can be implemented at once. The goal is to address the highest-risk gaps first.

• Recognize that people, processes, and technology all matter. Email security tools are essential. So is training employees to recognize what a phishing attempt looks like in 2025, not just what it looked like three years ago. So are business processes like verifying payment changes by phone. Defense in depth means addressing all three layers, not just the technical one.

• Continuously improve. As threats evolve, defenses must evolve with them. The organizations that fare best are the ones that treat cybersecurity as a running program, not a one-time project.

Q&A

How do I open a risk management conversation with a client without making it seem like we've missed something?

Frame it as education about evolution, not a confession of prior failure. Cybersecurity is a journey that changes as technology changes. Threats that are relevant today were not necessarily on anyone's radar a few years ago.

Start with the basics: what is cybersecurity, why does it matter for their specific business, and what does the current risk landscape actually look like for organizations like theirs.

Be honest: cyber criminals do not discriminate by size or sector, and small businesses are increasingly targeted. Sharing what you are seeing across your client base, without identifying specific clients, gives the conversation grounding in reality rather than hypothetical risk.

What is the biggest threat associated with SMS-based two-factor authentication?

SMS is the weakest form of MFA. The main risks are SIM swapping (where an attacker convinces a carrier to transfer a victim's phone number to their own device) and interception. The adversary-in-the-middle technique described above can also capture SMS codes in real time.

The recommendation is to move to authenticator apps as a minimum, and to hardware security keys for environments where the risk profile warrants it. Any MFA is better than none, but SMS should be treated as a floor to move beyond, not a finished solution.

Why do patching and email keep being the top attack vectors year after year, despite constant coverage?

Email persists because humans are genuinely hard to fool-proof. Phishing attacks have become more convincing, and MFA fatigue (where attackers bombard a user with authentication prompts until they approve one just to stop them) exploits normal human behavior. AI is making this worse.

On patching: the volume of security updates is substantial, the process of applying them often requires taking systems offline, and IT teams at most organizations are stretched. The practical recommendation is to prioritize external-facing systems first, targeting a 24-hour patching window from disclosure for critical vulnerabilities, followed by internal critical systems, and then the broader network.

The key is having a process and a prioritization framework rather than trying to patch everything at once.

Have you seen IoT devices being used to deploy ransomware, and what is the best defense?

Field Effect has not seen this pattern prominently in its IR caseload yet, but IoT devices carry the same fundamental risks as any other networked system: they have vulnerabilities, they receive updates infrequently, and they are often not treated as part of the security perimeter.

The principles that apply to other systems apply here too: keep devices updated and patched, and think carefully about network segmentation. IoT devices should not sit on the same network segment as critical business systems. If an IoT device is compromised, segmentation limits how far an attacker can travel from it.

What is the best way to store passwords safely?

A password manager. It removes the need to remember more than one or two credentials, generates complex unique passwords for every account, and eliminates the habit of reusing passwords across services. There are solid options available for both organizations and individuals. This is one of the highest-value, lowest-friction security improvements available to anyone.

Does using different network technologies like blockchain help with cybersecurity?

Not in any reliable way. Ransomware groups and other threat actor organizations operate like businesses: they hire staff, they adapt to new technology, and they find ways to exploit whatever their targets are using. Adopting a newer or more exotic technology does not make an organization safer; it just means attackers will eventually learn to exploit that technology too.

The fundamentals of good security practice, monitoring, patching, access controls, user education, outperform novelty every time.