.png)
Explore the latest trends, techniques, and procedures (TTPs) our incident response (IR) experts are actively facing with the TTP Briefing Q4 2025, a report built on frontline threat intelligence from our global incident response investigations, enriched by noteworthy detections from our SOC.
The TTP Briefing is grounded in real-world investigations led by our global IR and SOC teams across industries and geographies. As we continue the integration with LevelBlue and expand our threat intelligence to include trillions of events from SpiderLabs, this edition of our TTP Briefing primarily examines Cybereason’s findings from Q4, and compares certain trends to our findings in Q3 and H1 2025. Expect future TTP Briefing editions to include more findings from the unified LevelBlue DFIR, threat intelligence teams.
Findings from Q4 highlight that although organizations are improving detections and enabling faster response to malicious activity in their networks, threat actors are continuing to evolve their techniques to bypass controls. We’re seeing the first lines of defense are proving to be weaker to threat actors evolving tactics: MFA bypass rates are at an all time high, edge devices are being more commonly exploited, phishing tactics are evolving to bypass email security filters, and an uptick in SEO poisoning has lead to an increased downloading of Remote Access Tools (RATs). Although threat actors are not always getting through to ransomware detonation or data exfiltration, they have been gaining entry and viewing/accessing data, which can still trigger regulatory and data privacy issues.
For additional insights, join our IR experts on February 26 at 12:00 ET for a live webinar where they will unpack and dive deeper into our findings. Come armed with questions and walk away with actionable intelligence, detection priorities, and recommendations to strengthen your defenses.
Let’s explore a few key findings:
Most Common Threat Types
- Business email compromise (BEC) remained the top threat incident type, accounting for 42% of incidents.
- Ransomware was again the second most common incident type, at 28%.
- Network intrusion events not resulting in ransomware jumped from 7% in Q3 to 25% in Q4. This is in part due to organizations detecting pre-ransomware intrusions earlier, enabling faster response and less data exfiltration.
Initial Intrusion Vector (How Are They Getting In?)
Phishing remained the dominant initial intrusion vector in Q4 (52%), steadily increasing through 2025. Threat actors continue to vary their phishing tactics, catching victims off guard and gaining access to networks. One of the more unique phishing trends observed in Q4 2025 relates to calendar based phishing, where attackers send victims a calendar invite with a malicious login in the event description. These invites often slip by email filters, landing on victims calendars, appearing trustworthy and capturing credentials.
Calendar phishing example
Edge devices also remain a top concern, accounting for 18% of initial intrusion vectors. RDP and VPNs continue to be targeted by threat actors, leveraging weaknesses and vulnerabilities to exploit these devices.
Most Commonly Observed CVEs - Q4
|
CVE-2025-24472
|
FortiOS Authentication Bypass
|
|
CVE-2025-61882
|
Oracle
|
|
CVE-2025-40601
|
SonicWall SonicOS SSL-VPN
|
|
CVE-2024-55591
|
Fortinet FortiOS
|
|
CVE-2024-53705
|
SonicWall SonicOS SSH
|
|
CVE‑2024‑53704
|
SonicWall SonicOS SSL-VPN
|
|
CVE‑2024‑40762
|
SonicWall SonicOS SSL-VPN
|
|
CVE-2024-21762
|
Fortinet FortiOS
|
|
CVE-2023-399280
|
SonicWall SonicOS Stack-Based Buffer Overflow
|
|
CVE-2023-399279
|
SonicWall SonicOS Stack-Based Buffer Overflow
|
|
CVE-2023-399278
|
SonicWall SonicOS
|
|
CVE-2023-38277
|
SonicWall SonicOS Stack-Based Buffer Overflow
|
|
CVE-2023-39276
|
SonicWall SonicOS Stack-Based Buffer Overflow
|
|
CVE-2019-18935
|
Telerik UI
|
MFA Implementation Continues To Rise, with MFA Bypass at an All Time High
MFA Bypass over time
In Q4 we continued to see more organizations regularly implementing MFA, up to 92% from 53% in H1, and 75% in Q3. While MFA is becoming more widely implemented, we saw it being bypassed by threat actors almost every time (96%). This demonstrates that diverse phishing tactics, attackers in the middle (AiTM), and session token interceptions remain prevalent threats.
Most Targeted Industries & Company Sizes
Similarly to Q3 and H1, financial services remains the most targeted industry. This quarter, we saw an increased targeting of both Legal & Professional Services and Manufacturing, both steadily rising from Q3 and H1.
Organizations with revenue between $1M - $10M were the most frequently impacted, indicating that even small businesses still need to prioritize maturing their cyber defenses.
Tactics Across the Intrusion Path
The TTP Briefing provides data across the five stages of the intrusion path, from initial intrusion to persistence and escalation techniques, to exfiltration and monetization tactics. Noteworthy findings include:
- Threat actors continue to leverage Anydesk and Netscan as the most common tools for persistence.
- Remote access tools (RATs) have increased as a method for escalation, due to more frequent SEO poisoning, leading to the inadvertent download of malicious tooling.
- While there’s been an increase in pre-ransomware attacks, threat actors are less frequently reaching the exfiltration stage. Our findings show evidence of files being viewed/accessed, but early detection helps activate response in time to avoid data exfiltration.
SEO Poisoning Increases RAT Downloads
Increase in Remote Access Tool (RAT) usage over time
In Q4, we observed a sharp rise in SEO poisoning campaigns designed to trick users into downloading legitimate-looking Remote Access Tools (RATs), dramatically expanding attacker footholds inside enterprise environments. The use of RATs for privilege escalation surged from just 3% of investigations in Q3 to 60% in Q4, signalling a shift from opportunistic use to systematic deployment for persistence, credential access, and internal reconnaissance.
Once the user installs these tools, they enable broader asset discovery and lateral movement to the attacker. This is also reflected in a parallel increase in network intrusion activity, which rose from 7% in Q3 to 25% in Q4. Together, these trends indicate that threat actors are increasingly abusing trusted software and search results as an initial access vector, allowing them to blend in with legitimate IT activity while rapidly escalating privileges and expanding their reach across the network.
A Look Into Dwell Time
In the TTP Briefing, we exclude any MDR clients and measure dwell time the initial date of the compromise until our IR team is engaged. 42% of our cases had 31+ day dwell time, up from 38% in Q3, demonstrating that threat actors remain stealthy in environments, careful to stay undetected for longer periods.
One factor that can contribute to the appearance of longer dwell times relates to initial access brokers (IABs), who obtain unauthorized access and then sell that access to another threat actor group. Therefore, we often observe a latency period between initial exploitation and the new threat actor leveraging the unauthorized access. During the latency period, within the overall 31+ dwell time averages, there is commonly no active malicious activity going on in the network, but the organization has been compromised.
If you would like more information about this report, our team is available 24x7 at response@cybereason.com
Facts Only
Business email compromise (BEC) was the top threat incident type in Q4 2025, accounting for 42% of incidents.
Ransomware was the second most common incident type, at 28%.
Network intrusion events not resulting in ransomware increased from 7% in Q3 to 25% in Q4.
Phishing was the dominant initial intrusion vector in Q4, accounting for 52% of cases.
Calendar-based phishing, involving malicious login links in calendar invites, was observed as a unique trend in Q4.
Edge devices, including RDP and VPNs, accounted for 18% of initial intrusion vectors.
MFA adoption rose to 92% of organizations in Q4, up from 53% in H1 and 75% in Q3.
MFA bypass rates reached 96% in Q4, the highest recorded.
Financial services remained the most targeted industry, with increased targeting of Legal & Professional Services and Manufacturing.
Organizations with revenue between $1M and $10M were the most frequently impacted.
SEO poisoning campaigns led to a surge in Remote Access Tool (RAT) downloads, with RAT usage for privilege escalation rising from 3% in Q3 to 60% in Q4.
Dwell times of 31+ days were observed in 42% of cases, up from 38% in Q3.
Executive Summary
Full Take
The strongest version of this narrative highlights a clear and concerning evolution in cyber threats: despite organizations improving detection and response capabilities, threat actors are adapting with alarming agility. The report deserves credit for its granularity—detailing specific tactics like calendar phishing and SEO poisoning, which reveal how attackers exploit trust in everyday tools. The rise in MFA adoption paired with near-universal bypass rates underscores a critical paradox: security measures are necessary but increasingly insufficient without layered defenses. The data also challenges the assumption that smaller businesses are less targeted, showing that organizations with $1M–$10M in revenue are the most frequently impacted, likely due to weaker defenses relative to larger enterprises.
Patterns detected: none. The report avoids emotional exploitation or distortion, presenting data-driven insights without sensationalism. However, the root cause paradigm here is the perpetual arms race in cybersecurity—where defenders and attackers co-evolve, but attackers often have the advantage of asymmetry. The implications for human agency are significant: individuals and organizations must recognize that no single solution (like MFA) is foolproof, and that vigilance requires adapting to tactics that weaponize human trust and behavioral patterns.
Key questions emerge: How can organizations balance usability and security when attackers exploit legitimate tools like RATs and calendar invites? What structural incentives could reduce the market for initial access brokers, who prolong dwell times by selling compromised access? And critically, how might the increasing sophistication of phishing and SEO poisoning reshape user education and technical controls?
If this were part of a coordinated influence campaign, the playbook might involve exaggerating the inevitability of breaches to sell security products or services. However, the report’s focus on actionable intelligence—such as specific CVEs and tactical shifts—aligns more with genuine threat intelligence than fear-mongering. The content does not match a manipulative pattern; it serves as a clear call to adapt defenses rather than resign to defeat.