Ransomware remains the biggest driver of cybersecurity incident responses, according to the newest Threat Report from Arctic Wolf.

Further, three cyber incident types account for 95% of all IR cases, despite the ransomware landscape becoming ever-more democratised as the barrier to entry is continually lowered by advancing technologies like AI, and the proliferation of IoT devices opening up new vulnerable avenues for attack.

Arctic Wolf’s 2025 Threat Report draws on first-hand experience of the firm’s security experts, as well as research from the team into the overall cyber threat landscape.

The report details the ever-expanding realm of ransomware-as-a-service (RaaS) offerings, as well as the important of prioritisation when it comes to patch strategies.

Ransomware (44%), business email compromise (27%) and intrusions (24%) are the three leading case incidences the cyber team found.

While this level is fairly consistent, there is a slight increase in the level of intrusions, balanced by a relative decrease in ransomware attacks. Arctic Wolf found that most ransomware attacks were stopped prior to detonation, as organisations are improving their detection capabilities.

Ransomware

Ransomware attacks are however, attempting to increase their severity as potential victims implement more reliable backup and restoration processes. In retaliation, ransomware groups are introducing data exfiltration as a means to apply additional pressure and protect their revenue streams.

This is becoming the norm, the research found, as 96% of ransomware incidents investigated included data exfiltration. Despite its prevalence, backups are still vital: in 68% of ransomware incidents, backups aided the recovery process.

Ransomware is only growing, as the RaaS model becomes mainstream and more and more gangs vie for a piece of the lucrative action. Arctic Wolf identified over 50 unique ransomware threat actors in victim environments in their research.

Email Compromise and Intrusions

Business email compromise is on the rise for businesses that deal with money – organisations that regularly exchange money and process payment details over email are consistently in the crosshairs of these attacks.

The finance and insurance industry therefore account for 26.5% of BEC cases, which accounted for over half (53%) of incident response cases for these industries.

Recommended reading

• As-a-Service Platforms Drive Four-fold Ransomware Increase
• UK Proposes Ban on Public Sector Ransomware Payments
• Ransomware Payouts Plummet by £350M in 2024

Phishing and compromised credentials are behind the vast majority of BEC cases; multi-factor authentication however, can help mitigate the effectiveness of these methods.

For intrusion, low tech methods are consistently employed by cyber-criminals who target unsecured remote desktop protocol (RDP) and compromised VPN credentials to gain access to systems and data.

In 76% of intrusion cases, threat actors employed at least one of 10 specific vulnerabilities, none of which were zero-days.

Patch management can be incredibly important, and while the task can seem never-ending, prioritisation can ensure attacker’s favourite means of infiltration are blocked.

Patching critical infrastructure, specially VPN services and edge devices are vital facets of building a robust cyber defence.

“The 2025 Arctic Wolf Threat Report highlights a critical shift in cybercriminal behavior: data exfiltration has become the norm, not the exception,” said Kerri Shafer-Page, vice president of incident response, Arctic Wolf.

“Threat actors are no longer just locking up data with ransomware; they’re stealing it first to maximize pressure on victims.

“The insights help organizations understand the risks they face today and shape the advanced detection and response strategies embedded within the Arctic Wolf Aurora Platform to keep our customers secure.”