Hackers have ‘industrialised’ cyber-crime, and are becoming faster, craftier, and harder to spot according to the latest research from cybersecurity platform Huntress.

Insights from the firm’s 2025 Cyber Threat Report shows that threat actors are gaining in sophistication, taking methods and strategies tested on larger companies and applying them to organisations of every size, with often dire consequences for victims. 

Evasion techniques once considered among the most advanced threats have now become the new normal, including endpoint detection and response tampering, bring your own vulnerable driver (BYOVD) privilege escalations, and User Account Control bypasses.

Huntress found that the majority of attacks in 2024 (87%) were automated or helped along by automated tools, with hackers using malware, scripts, and other automated methods to conduct widespread, low-effort campaigns more efficiently. 

Once attackers gained access, they were observed moving to more focused ‘hands-on-keyboard’ (HOK) activity, where manual actions like lateral movement or domain enumeration were executed. 

According to the report, HOK activity spiked in February, June, July, and November 2024, with activity most common during US East Coast business hours, timing which suggests attackers are exploiting normal business activity as a cover, or else need devices and personnel to be active for social engineering tactics to work.

Among these tactics, phishing is still a core tool for attackers to gain initial access and investigate victim’s systems, before moving towards more sophisticated tactics like QR code phishing and Living Off Trusted Sites (LoTS).

QR code phishing – where users are sent an email with a QR that directs to a malicious site – accounted for 8.1% of phishing emails, while 7% involved LoTS, a tactic that abuses legitimate platforms to share malicious documents.

Infostealers are also becoming more prominent, accounting for nearly a quarter (24%) of all incidents observed by Huntress, with even adware and other unwanted programs, once seen as harmless infections now containing infostealing features that take sensitive data, contributing to a rise in incidents.

Automation is having an impact too, with attackers now turning to ‘hack tools’ to perform actions as quickly as possible when attempting to compromise machines en masse.

These bundles of software allow hackers to perform many complex activities like password sniffing, memory dumping, decrypting files, manipulation of targeted applications, or remote access to a compromised machine with a simple button press, with the Cobalt Strike tool being the most popular, observed in almost a third of all attacks (32%). 

Huntress said that these advanced techniques mark a shift toward more targeted and deceptive strategies designed to exploit trust and evade traditional email filters.

Recommended reading

• 75% of Organisations Hit by Ransomware More Than Once
• What Do Hackers Think About AI?
• Over Half of Hacked UK Firms Pay Ransom

“Hacker tradecraft is evolving fast, with ransomware groups growing bolder, attacks becoming harder to detect, and phishing scams reaching new levels of sophistication,” said Jamie Levy, director of adversary tactics at Huntress.

“To stay ahead, organisations need a well-rehearsed incident response plan, ongoing vulnerability assessments, timely patching, and security awareness training that actually sticks. 

“With ransomware deployed within hours of initial access, taking proactive steps now is essential to minimising the impact of a breach.”