A 2025 Threat Trends Analysis

LevelBlue’s 2025 DFIR trends report documents three major threats: (1) Luna Moth’s callback-phishing and IT-impersonation campaigns that gain remote access (Zoho Assist/Atera), exfiltrate data (WinSCP/Rclone), and extort victims; (2) Akira’s exploitation of SonicWall CVEs and use of SEO-poisoned spoofed domains to deliver Bumblebee, leading to lateral movement and Akira ransomware; and (3) increased social-engineering leveraging Microsoft Quick Assist/Teams to obtain desktop access, perform reconnaissance, deploy remote access tools, exfiltrate data, and deploy ransomware—while enumerating frequently exploited CVEs, top malware families, observed TTPs (SSH tunneling, living-off-the-land), and recommended emphasis on behavioral detection.