2025 Threat Insights Report: Global TTP Trends from the Attacker's Perspective

As cyber attacks accelerate towards automation and link-based evolution, a single vulnerability perspective is no longer sufficient to reconstruct the full picture of real threats.

As a leading intelligent security validation platform in China, Scythe Validation continuously tracks active global threats from the attacker's perspective, translating cutting-edge offensive and defensive research into actionable, measurable validation and detection capabilities.

Based on the practical data accumulated over the past year, Scythe Security Lab has officially released the "2025 Threat Insight Report." The report not only systematically organizes the annual updates to the attack library but also reveals the brand new challenges faced by corporate defense systems under the waves of localization substitution, IoT popularization, and AI.

(Follow the official account and reply with "2025" to obtain the full version of the report)

Part 01

Scale and Coverage: Bi-directional Boost to Defense Capability Enhancement

In 2025, Scythe Validation's attack library achieved synchronous volume updates in validation and detection capabilities, especially with deep adaptation targeted at China's unique network environments:

• 6882 new validation rules: Comprehensively simulating real attack techniques, with continuously expanding coverage.

• 1099 new detection rules: Helping defenders focus on covering detection blind spots in domestic software and IoT devices.

Part 02

Target Shift: Domestic Core Software and IoT Become Hardest Hit Areas

Compared with previous years, the attack targets in 2025 present a clear trend of localization and marginalization.

• Core Business Systems Become "Bullseye": Data bubble charts show that attack firepower is highly concentrated on domestic ERP and OA vendors such as Yonyou, Kingdee, Weaver, and Landray. Attackers are not satisfied with peripheral systems; instead, they exploit enterprises' strong dependence on these core office systems to perform high-frequency supply chain penetration, aiming directly at core data.

• Internet of Things (IoT) Becomes Intranet Jumpboard: Detection rules targeting video surveillance manufacturers such as Tiandy, Dahua, and Hikvision have increased significantly. This also confirms a trend: security devices with their own Web management platforms are becoming important jumpboards for hackers to bypass boundary protection and slip into intranets.

Part 03

Evolution of Tactics and Techniques: Covert Communication and Long-term Lurking

Within the MITRE ATT&CK tactic distribution, attackers demonstrated stronger counter-reconnaissance awareness and persistence intentions.

• Covert C2 Communication: TA0011 (Command and Control) accounts for an extremely high proportion. Attackers use DNS, ICMP, and Web protocols to build covert tunnels, attempting to "go invisible" in massive traffic.

• Persistence Becomes the Norm: WebShell implantation and system process hijacking have become standard actions for hackers after gaining privileges, which also explains why the number of file operation-type (upload/read) attack rules has surged.

☟ Swipe left and right to see more

Part 04

New Frontier of Offense and Defense: AI Entry and SQL Injection Top the Charts

• The First Year of AI Security Validation: The attack library included 22 security validation rules targeting AI applications for the first time. As AI applications are developed and deployed in enterprises, new attacks targeting AI application components like Prompt Injection are already on the horizon.

• SQL Injection Continues to Top the Charts: In the Web attack category, SQL injection ranks first with an overwhelming number. This indicates that in today's increasingly complex business logic, attacking and stealing data through Web front-end vulnerabilities remains the most frequently tried primary method by hackers.

Part 05

Vulnerability Inventory: The Defensive Dilemma of Coexisting New and Old

In the TOP 5 active vulnerabilities of the year, we saw a worrying phenomenon: N-day vulnerabilities exhibit extremely resilient vitality.

• The Top Spot is Surprisingly an 8-Year-Old Vulnerability: CVE-2017-0199 (Office RTF) remains the vulnerability with the highest utilization rate, indicating that terminal patch management in many enterprises still has blind spots.

• New Vulnerabilities Weaponize Extremely Fast: The React2Shell and WSUS vulnerabilities that broke out in 2025 quickly rushed into the top five, leaving an increasingly shorter response window for defenders.

Part 06

Adversary Profiling: Lurking and Data Theft Become Mainstream

• Most Active Hacker Groups: This year, 270 threat groups were tracked closely. Among them, APT38 (Lazarus) and Patchwork had the highest activity, launching intensive cyber espionage operations against governments and scientific research institutions in East Asia.

• Most Popular Malware: The usage rates of Trojans and HackTools have surpassed ransomware. This indicates that attackers are no longer in a hurry to extort money for cash, but prefer to use commercialized hacking tools for long-term lurking and covert data theft.

  

Part 07

Scythe Security Lab: Continuous Vulnerability Mining, Practice-Driven Security

Scythe Security Lab accumulated a total of 19 original vulnerabilities mined and recorded by CNNVD during the year, focusing primarily on core enterprise business systems and critical IoT devices, filling the blind spots of general defense systems. The mining targets achieved full coverage from applications to infrastructure.

The security research team translates all first-hand vulnerability intelligence into validation rules and detection rules at the earliest opportunity, while providing timely replication and mitigation solutions to ensure customers possess a defensive vision that is one step ahead.

▶▶▶ Please click "2025" to get the full PDF report.