A 2025 Threat Trends Analysis

LevelBlue's 2025 threat overview identifies three dominant trends: Luna Moth’s callback-phishing campaign enabling remote-access and data extortion against professional services; Akira’s exploitation of SonicWall vulnerabilities and SEO-poisoned installers to deploy Bumblebee and follow-on ransomware; and increasing abuse of Microsoft Quick Assist/Teams social-engineering to gain interactive access and deploy ransomware and data theft tools. The report catalogs active exploited CVEs (SonicWall, FortiOS, Ivanti, SAP), top malware families and tools, and MITRE-style TTPs, emphasizing a shift toward living-off-the-land techniques and human-focused attacks that demand behavioral detection.