Most Common Cyber Attacks and Trends of 2025

Cybercrime is evolving rapidly, with attack volume and sophistication breaking new records in 2025. The scale and impact of cyber threats now affect organisations across every sector, including housing, finance, healthcare, and public sector bodies. Understanding the most prevalent attack types and their underlying drivers is essential for robust governance, risk management, and compliance.

Key Drivers Behind the Surge in Cyber Threats

Modern attackers are using new technologies and tactics to automate, scale, and target victims globally:

AI-powered cybercrime is driving automated, scalable attacks and producing nearly undetectable phishing and deepfake content.
Supply chain exploitation is rising, with criminals leveraging trusted vendor or software relationships to infiltrate targets and bypass defences.
Targeted extortion, data theft, and service interruptions are sharply increasing, driven by the expansion of “ransomware-as-a-service” and criminal business models.

Below, the most prevalent cyber attacks in 2025 are examined, with fresh industry data and insight into their evolving tactics.

Ransomware: The Relentless Threat

Ransomware remains the most disruptive and high-profile cyber threat. Groups deploy increasingly aggressive double extortion, encrypting data while threatening public leaks of sensitive information if ransoms aren’t paid. The healthcare, financial, and public sectors are prime targets, with ransomware-as-a-service dramatically lowering entry barriers for attackers.

The number of ransomware victims surged to over 2,000 per quarter by early 2025, a rapid increase from under 1,000 victims in early 2023. According to: s3.amazonaws

Ransomware attack victims per quarter (2023-2025)

This surge highlights both criminal innovation and gaps in organisational resilience. Phishing remains the most common infection vector, but attackers now blend tactics with supply chain attacks and advanced persistence techniques.

Phishing evolves constantly and remains the root cause of countless breaches. In 2025, AI-driven phishing stands out, such as malicious actors use large language models and deepfake technologies to craft hyper-personalised, convincing campaigns. Email, SMS (“smishing”), and voice calls (“vishing”) are all used, and even short-lived sessions or one-time codes can be intercepted if multi-factor authentication isn’t implemented or is poorly configured.

Recent research shows 42% of organisations report phishing/social engineering as their most frequent attack vector. This trend is amplified by generative AI tools, enabling attackers to automate sophisticated scams at scale.

Distributed Denial of Service (DDoS) Attacks

DDoS attacks, which flood systems with traffic to render services unavailable, show no sign of abating. The trend in 2025 is toward “multi-vector DDoS,” where attackers combine bandwidth floods with application-level and protocol-based attacks. These assaults can target public websites, remote working tools, or critical infrastructure.

Mid-2025 saw DDoS attacks grow 25% year-on-year, driven by botnet infections and criminal service providers offering DDoS for hire.

Supply Chain Attacks

Supply chain attacks, where criminals compromise trusted software or hardware before it reaches the final target, are increasingly difficult to detect and prevent. In 2025, third-party vendors and open-source projects remain major risks due to complex, interconnected supply webs.

Examples include:

Malware inserted in widely used vendor updates
Compromised managed service providers (MSPs)
Bi-directional trust exploitation between partner organisations

High-profile breaches have led to renewed focus on supplier due diligence and zero-trust architectures.

Man-in-the-Middle and Session Hijacking

Man-in-the-Middle (MitM) attacks exploit insecure communications, intercepting and manipulating data streams in real-time. As mobile and remote work increase, risks from poorly protected public WiFi, legacy VPNs, or insecure APIs have kept these tactics relevant.

AI-Powered and Deepfake-Enabled Attacks

One of 2025’s defining trends is malicious use of AI:

Generative AI automates the creation of phishing, malware, and fake content.
Deepfake audio and video attacks are used for business email compromise and CEO impersonation.
AI-enhanced attacks quickly adapt, bypassing traditional detection methods.

2025 Attack Distribution Overview

Here’s how the most common vectors break down in 2025:

Cyber attack vector distribution in 2025 – Source: s3.amazonaws

Attack Type	Percentage
Ransomware	30% connectwise
Phishing/Social Engineering	28% gov
DDoS	18% cyberproof
Supply Chain Attacks	12% cloudsecurityalliance
Man-in-the-Middle	7% rapid7
Other	5% weforum

Cyber Attack Trends Shaping the Threat Landscape

1. AI-adapted Defenses

As attackers leverage machine learning, defenders must deploy AI and automation for threat detection, behaviour analytics, and rapid response. weforum+1

2. Rise of Ransomware-as-a-Service

Toolkits and “criminal franchise” models have dramatically increased attack frequency. cyberproof

3. Zero Trust Security Models

Organisations move toward “never trust, always verify,” segmenting networks and controlling access based on strong authentication and real-time risk.

4. Human Layer Attacks

The human “attack surface” is exploited by vishing, BEC, and fraud campaigns using social engineering.

5. Quantum Risk on the Horizon

Warnings grow that future quantum computers may someday break today’s cryptography, prompting “harvest now, decrypt later” strategies from adversaries.

6. AI-Driven Internal Fraud: Fake Expense Receipts

A striking 2025 trend is the rise of AI-powered internal fraud, especially staff leveraging artificial intelligence tools to create convincing fake expense receipts. Recent industry analyses reveal that in September 2025, AI-generated fake receipts accounted for approximately 14% of all documented fraudulent expense claims, up from essentially zero incidences in 2024. These tools allow employees to fabricate highly realistic receipts that can be nearly indistinguishable from authentic ones, making it far easier for fraudulent claims to pass through traditional review processes. sumsub+3

Modern AI models can simulate thermal paper, replicate logos and itemized lists, and even add synthetic wear and tear, creating forgeries that evade visual inspection. Expense management platforms have collectively flagged over $1 million in fraudulent claims in just three months, signaling a democratization of document forgery. Top finance and GRC experts now advise: “Do not trust your eyes”and recommend a combination of automated AI-driven fraud detection tools and thorough logical checks to spot fabricated or inconsistent documentation. icaew+3

Common red flags include:

Receipts that don’t match a real business, venue, or knowable transaction record
Suspiciously repeated expense values or totals just under policy thresholds
Inconsistent, missing, or obviously tampered VAT or transaction details

Organisations should combine automated scanning tools with robust internal controls, regular expense audits, and GRC-led staff education to mitigate this rapidly evolving form of internal fraud.

Defending Against Modern Attacks

Best practice recommendations for UK organisations include:

Multi-factor Authentication: Strong MFA, especially hardware-backed or app-based rather than SMS-based, for all remote and privileged access.
User Awareness Training: Regular, GRC-aligned training for staff to recognize phishing, smishing, and vishing attempts.
Active Supplier Management: End-to-end due diligence, contract clauses, and continuous monitoring for third-party cyber risks.
Zero Trust Principles: Assume breach, segment networks, and minimize privileged access windows.
AI and Automation: Use machine learning for anomaly detection and incident response.
Incident Response Plan: Up-to-date and frequently tested, ensuring rapid containment of ransomware and data breach scenarios.

References and Further Reading

Ready to Strengthen Your Cybersecurity?

Get in touch to learn more about our Virtual DPO and Cybersecurity services and how we can support your organisation.

Learn more about our Data Protection and Cybersecurity Services and how we support UK organisations with GRC implementation.

Most Common Cyber Attacks in 2025: Trends, Data & Effective GRC Strategies