2025 State of the Internet Report: Summary and Conclusions

The Censys Research Team presents a consolidated summary of their 2025 State of the Internet series, highlighting active exploitation of high-impact vulnerabilities (Cleo and FortiOS/FortiProxy zero day), widespread ransomware activity (CL0P, Termite, DragonForce), APT malware investigations (Turla/Wainscot and DPRK BeaverTail/InvisibleFerret), measurement studies of C2 lifespans, the emergence of PolarEdge as a large-scale residential proxy IoT botnet (~40,000 devices), and open-directory content persistence—demonstrating persistent, multi-faceted malicious infrastructure and the value of Internet-wide scan data for tracking threat actor operations.