The Modern Threat Actors’ Playbook: How Initial Access and Ransomware Deployment Trends are Shifting in 2025

As threat actors’ Tactics, Techniques, and Procedures (TTPs) become more complex, it becomes all that more critical for security leaders to understand how they are gaining initial access and fulfilling their objectives within an organization. 

With ransomware increasingly originating from out-of-scope endpoints and browser-based malware, and the rise of valid credential abuse, organizations need 24/7 real-time threat detection and response, actionable threat intelligence to develop novel detections, comprehensive endpoint protection, and proactive measures against advanced emerging cyber threats.

In this annual report from eSentire’s Threat Response Unit (TRU), we share the latest research conducted by TRU that highlights the most pressing threats impacting global organizations, such as business email compromise (BEC) attacks, signed malware, and ransomware.

New observations shared in this report show:

• Why, and how, valid credentials dominated as an initial access vector into corporate environments in 2024.
• Construction and Transportation industries seeing a greater share of valid credential abuse, primarily in phishing and BEC incidents.
• Why browser-based delivery, which includes techniques like malvertising, SEO poisoning, and fake browser updates accounts for 70% of malware cases analyzed by TRU. 
• TRU’s projections of what organizations should expect in 2025, including rise in politically motivated cyberattacks, disruption of the physical infrastructure of the Internet, abuse of certificate authority, and an increase in browser-based threats to deploy malware. 
• Recommendations from TRU for 2025 on how your organization can anticipate, withstand, and recover from the most sophisticated ransomware attacks.

Download our 2024 threat recap and 2025 threat landscape outlook report to help you reduce your cyber risks, build resilience, and prevent business disruption.