OPSWAT, a global critical infrastructure protection company, published its inaugural ‘2025 OPSWAT Threat Landscape Report’ on Wednesday, offering a deep dive into over 890,000 sandbox scans conducted in the past year, disclosing that adversaries are innovating faster than static defenses can adapt. The report recognizes that attacks on operational technology (OT) and critical infrastructure have continued their upward trajectory in 2025. Sectors such as manufacturing, energy, and utilities remain at the forefront of threat actor targeting, with financial and espionage motivations both in play.
The findings reveal a 127% surge in malware complexity over just six months, measured through multi-stage execution chains and obfuscation tactics designed to mislead traditional security tools, with legacy systems failing to detect one in every 14 threats. The report warns that evasive, signature-resistant malware is bypassing traditional defenses, underscoring the urgent need for adaptive, behavior-based, multilayered protection strategies.
Notably, 7.3% of files undetected by public OSINT feeds were reclassified as malicious by the emulation-based sandbox 24 hours earlier than conventional sources on average. This gap highlights the growing limitations of signature- and reputation-based tools in the face of zero-day and fileless threats. Attackers continue to favor stealth and adaptability, as malware families now commonly embed payloads in benign-seeming formats such as [dot]NET Bitmaps, steganographic images, and even Google services abused for covert command-and-control.
Emerging techniques like ClickFix, a clipboard-based social engineering tactic, are gaining ground among both criminal and nation-state actors. The data shows malware is built to evade, not overwhelm, making behavioral analysis, backed by sophisticated anti-evasion technology, essential. With 99.97% detection efficacy across scripts, executables, and documents, the report shows that dynamic pipelines rooted in emulation and behavioral correlation can reveal campaigns that remain invisible to legacy AV and EDR stacks.
“Our strength lies in precision, behavioral depth, and early visibility into emerging attacks,” Jan Miller, chief technology officer of threat analysis at OPSWAT, said in a media statement. “That’s what sets OPSWAT apart in delivering high-fidelity, context-aware threat intelligence.”
This matters as critical infrastructure installations, government systems, and enterprise networks are facing relentless targeting by increasingly modular, evasive malware. The report highlights how adversaries are refining their tactics and why organizations can’t afford to rely on outdated defenses.
The report identified that the attack surface is expanding as fast as attackers are innovating. “From supply chain compromises and OT system infiltration to phishing and polymorphic malware, defenders face a layered and increasingly evasive threat landscape. The rise in ransomware and credential theft, backed by data from Verizon’s 2025 DBIR and supporting threat intelligence partners, confirms that foundational controls such as vulnerability management, file inspection, and phishing defense must evolve—and fast,” it added.
It also noted that threat activity over the past year reveals consistent clusters of techniques, each representing repeatable playbooks observed across campaigns. Rather than isolated IOCs, these clusters reflect the chaining of tactics like script obfuscation, geofencing, and adaptive social engineering. Each example in this section is grounded in real-world timelines and validated through sandbox telemetry. Together, they showcase how adversaries combine simplicity and stealth to evade detection and how adaptive sandboxing unmasks their strategies.
OPSWAT reported that phishing websites are designed for rapid deployment and short lifespans, with the majority being taken down within the first 24 hours. “Only a small fraction of phishing sites remain active beyond this critical window, underscoring the need for swift detection and response.”
Furthermore, while most phishing sites employ unique templates to evade reputation-based defenses, a significant minority (20%) reuse identical HTML templates across multiple domains. This tactic allows attackers to bypass traditional detection methods that rely on domain reputation or blacklists. These insights highlight the importance of real-time, content-based detection strategies.
By understanding the lifecycle and template reuse patterns of phishing sites, security teams can prioritize rapid, adaptive defenses that are resilient to both fast turnover and template-based evasion techniques.
Heuristics, derived from empirical data and visual analysis, provide high-confidence, low-cost rules for real-time phishing detection. Each rule leverages the clear behavioral gaps between benign and phishing sessions, as seen in the plots. Implementing these checks at the network edge or in SIEM workflows enables rapid identification and containment of phishing threats, with minimal false positives. Combining these rules with existing detection logic can improve coverage and operational efficiency for SOC teams.
As malware continues to evolve beyond static indicators and known signatures, defenders must adopt a new mindset, one that prioritizes execution context over static classification. These threats are dynamic, adaptive, and increasingly embedded in seemingly benign activity. From obfuscated loaders and memory-resident payloads to social engineering tactics like ClickFix, attackers exploit blind spots that evade traditional detection systems.
To stay ahead, cybersecurity leaders must prioritize adaptability, invest in shared threat intelligence, reassess outdated technologies, and build faster behavioral detection pipelines. It’s no longer just about blocking known threats, but it’s about being ready for what’s next.
The OPSWAT report outlines a set of clear recommendations for defenders facing a fast-evolving threat landscape. A strong, proactive defense strategy is essential, and a well-defined Security Operations Center (SOC) must sit at the center of it. Security teams need to align strategic priorities with actionable, telemetry-driven insights and role-specific playbooks. Organizations should elevate their approach to continuous detection and response, ensuring around-the-clock monitoring and automated threat containment the moment malicious activity is detected.
Behavioral analytics and threat correlation must become core capabilities. By tracking deviations in user and system behavior and connecting seemingly unrelated security events, defenders can uncover stealthy, sophisticated threats that bypass traditional detection tools, while cutting down on false positives.
Vulnerability management also needs to be risk-driven and agile. With over 45,000 CVEs expected in 2025 alone, security teams must identify and prioritize patching efforts based on actual exposure and business risk. Finally, regulatory compliance, whether under NIS2, the EU Cyber Resilience Act, or U.S. SEC cyber rules, should be treated as a pillar of operational resilience, not a checklist. Complete coverage and control implementation must be the standard.
