A recent report has found that cyber threats worldwide intensified in the final quarter of last year. Beazley Security noted that attackers have increasingly taken advantage of stolen credentials and the rapid exploitation of vulnerabilities, often striking before vendors could release patches.
The report added that internet-facing systems, identity providers, and remote access platforms were the most targeted entry points.
Ransomware remained a significant concern, with established groups like Akira and Qilin continuing to dominate. The study found that leak site posts surged nearly 50%, reflecting a growing willingness among cybercriminals to escalate public pressure when negotiations failed. The ransomware ecosystem is also seeing new entrants and “lone wolf” actors, creating a more dispersed and opportunistic threat environment.
Business email compromise (BEC) attacks accounted for around a third of reported incidents, despite multi-factor authentication being in place, with attackers using methods such as session hijacking and token replay. Nearly half of the successful BEC attacks occurred even in environments with MFA enabled, underscoring the increasing sophistication of identity-based attacks. Beazley’s Managed Detection and Response telemetry highlighted a shift towards early-stage containment, stopping intrusions before they could spread.
The report also noted that over 12,800 new vulnerabilities were disclosed in Q4, with several actively exploited before public disclosure. Law enforcement crackdowns, such as Operation ENDGAME, disrupted infostealer markets, yet demand for credential theft remained strong. New malware families like StealC are emerging to fill gaps, while AI-driven reconnaissance and deepfake social engineering are accelerating attacks, reinforcing the need for organisations to strengthen fundamental defences such as phishing-resistant authentication and rapid patching.