New research from Darktrace observed a broad spectrum of attack tactics used by a range of threat actors, including advanced persistent threats (APTs), Malware-as-a-Service (MaaS), and Ransomware-as-a-Service (RaaS) groups in the first six months of this year. These findings, drawn from activity targeting Darktrace customers, reflect a rapidly evolving threat landscape where adversaries are continually refining their tactics, techniques, and procedures (TTPs), making it increasingly difficult for organizations to harden their defenses.
Notably, a growing number of attackers are integrating AI, particularly large language models (LLMs), into their operations to increase the scale, complexity, and effectiveness of their campaigns. The emergence of malware like LameHug, recently detailed by CERT-UA and powered by an open-source LLM, underscores this shift toward more intelligent and adaptive threats.
The research also identifies that hackers apply AI to email attacks, as LLMs present a clear opportunity for attackers to take advantage of AI and create effective phishing emails at speed. “While Darktrace cannot definitively confirm the use of AI to create the phishing emails observed across the customer base, the high volume of phishing emails and notable shifts in tactic could potentially be explained by threat actors adopting new tooling such as LLMs.”
Darktrace disclosed that it detected more than 12.6 million malicious emails between January and May 2025. VIP users remained a prime target, with over 25 percent of all phishing emails directed at them during this period. QR code-based phishing tactics also persisted, showing similar proportions when compared to the same timeframe in the previous year. February 2025 saw a spike, with more than one million QR code phishing emails detected that month alone.
The data also indicates a shift toward more sophisticated phishing campaigns, with a year-over-year increase in emails containing high text volume or multistage payloads. In the first five months of 2025, 32 percent of phishing emails featured a high volume of text, underscoring a trend toward more complex and deceptive messaging.
Throughout March and April 2025, Darktrace observed repeated instances of ClickFix social engineering campaigns, a technique that manipulates the intersection of human behavior and technology to deceive users into executing malicious code on behalf of attackers. Although this method has been in use since 2024, recent campaign activity indicates a resurgence in the first half of 2025.
Various hackers, including APTs, MaaS, and RaaS groups, have adopted ClickFix to deliver secondary payloads such as information-stealing malware. These attacks typically involve the use of fraudulent or compromised legitimate websites to host malicious plugins disguised as fake CAPTCHA challenges.
Targeted users, believing they are completing a human verification step or resolving a website issue, are unknowingly guided through a series of actions that ultimately execute PowerShell code on their systems. Darktrace observed such campaign activity across several sectors, including government, healthcare, insurance, retail, and non-profit organizations.
Darktrace also flags the rise of phishing kits like FlowerStorm and Mamba2FA, which enable phishing and abuse users’ trust by mimicking legitimate services to bypass multi-factor authentication (MFA), highlighting how the barriers to entry for sophisticated attacks continue to fall, enabling new threat actors.
The research also mentioned that RaaS has dominated the attack landscape, with groups like Qilin, RansomHub, and Lynx appearing multiple times in cases across Darktrace’s customer base over the past six months. “Detecting ransomware attacks before the encryption stage remains a significant challenge, particularly in RaaS operations where different affiliates often use varying techniques for initial entry and earlier stages of the attack. Darktrace’s recent analysis of Scattered Spider underscores the challenge of hardening defenses against such varying techniques.”
Exploitation of internet-facing devices remained a dominant theme in Darktrace’s threat investigations during the first half of 2025. The company observed active exploitation of several vulnerabilities, including CVE-2025-0282 in Ivanti Connect Secure and Policy Secure, CVE-2025-0994 in Trimble Cityworks, CVE-2024-57727 and CVE-2024-57728 in SimpleHelp Remote Monitoring and Management (RMM), CVE-2025-31324 in SAP NetWeaver, and CVE-2025-4427 and CVE-2025-4428 in Ivanti Endpoint Manager Mobile (EPMM).
Many of these exploitation activities appear consistent with broader industry reports suggesting that Chinese-nexus threat actors likely targeted these technologies even before the vulnerabilities were publicly disclosed. Notably, CVE-2025-0994 affected Trimble Cityworks, an asset management platform widely used by local governments, utilities, airports, and public works agencies, underscoring the high-risk exposure of critical infrastructure systems.
Darktrace detected signs of exploitation as early as Jan. 19, weeks before the vulnerability was publicly disclosed on Feb. 6. The initial indicator was a suspicious file download, which was later attributed to Chinese-speaking threat actors involved in a campaign targeting the U.S. government. The case underscores the serious risks associated with the exploitation of internet-facing systems, including widely used technologies and software tied to critical national infrastructure (CNI), a high-value target for sophisticated threat actors. It also highlights Darktrace’s capability to detect exploitation activity even in the absence of a publicly disclosed CVE.
During the period, Darktrace observed a broad spectrum of threats, ranging from APT operations to widespread phishing campaigns and the deployment of information stealers. One notable case involved BlindEagle (APT-C-36), which targeted customers in Latin America, with initial activity identified in February and further incidents continuing into June.
The research also identified a customer targeted in a China-linked campaign involving the LapDogs ORB network, with activity spanning from December 2024 through June 2025. These likely nation-state attacks reflect the growing integration of cyber and AI capabilities into the strategic objectives of certain governments. In parallel, Darktrace noted increasing sophistication in malware functionality. For instance, the malicious backdoor Auto-Color was found using suppression techniques to conceal its activity when unable to complete its kill chain, demonstrating how advanced tactics are now embedded at multiple layers of an attack.
In addition to emerging threats, Darktrace continues to observe the impact of previously known and less sophisticated tools, such as worms, remote access trojans (RATs), and information stealers, across its customer base. The Raspberry Robin worm, first identified in 2021, has been repeatedly detected in Darktrace environments since 2022, with the most recent cases occurring in April and May 2025. According to recent open-source intelligence (OSINT), Raspberry Robin appears to be evolving its role as an Initial Access Broker (IAB), enabling follow-on attacks and remaining a persistent concern.
RATs also continue to pose a threat, with variants such as AsyncRAT and Gh0st RAT observed targeting Darktrace customers. In April, multiple cases of MaaS activity were detected, involving the distribution of information stealers like Amadey and Stealc, as well as GhostSocks. In these incidents, Amadey served as the initial infection vector, with the other payloads deployed in follow-up stages.
In conclusion, Darktrace identified that as cyber threats evolve, attackers are increasingly harnessing AI to craft highly convincing email attacks, automating phishing campaigns at unprecedented scale and speed. This, coupled with rapid exploitation of vulnerabilities and the growing sophistication of ransomware gangs operating as organized crime syndicates, makes the threat landscape more dynamic and dangerous than ever.
Cyber defenders collaborate to combat these threats – the coordinated takedown of Lumma Stealer in May was a notable win for industry and law enforcement; however, OSINT suggests that this threat persists, and new threats will continue to arise.
“Traditional security tools that rely on static rules or signature-based detection often struggle to keep pace with these fast-moving, adaptive threats. In this environment, anomaly-based detection tools are no longer optional—they are essential,” the report added. “By identifying deviations in normal user and system behavior, tools like Darktrace provide a proactive layer of defense capable of detecting novel and emerging threats, even those that bypass conventional security measures. Investing in anomaly-based detection is critical to staying ahead of attackers who now operate with automation, intelligence, and global coordination.”
