【KROLL-2025研报】2025年8月威胁情报（TI）焦点趋势报告（英）.pdfVIP

ThreatIntelligence(TI)

SpotlightTrendsReport

August2025

2

Methodology

▪KrollTImonthlyspotlightsarebasedonintelligencefromKroll’scyberincidentresponse

engagementswhereweareengagedtorespond,manage,ormitigateacybersecurityincident.

Kroll’sincidentresponseworkisinformedbyintelligencegainedfromthethousandsof

engagementshandledperyearbytheKrollCyberDataResilienceteam.

▪DataiscollectedandprocessedbytheKrollCyberThreatIntelligenceteamduringtheinitial

scopingintakeaswellasduringthelifecycleofaKrollengagement.

▪Krollcurrentlyreportsondataonamonthlyandquarterlybasisthroughthemonthlyspotlights

andQuarterlyThreatLandscapereports.

TLP:CLEAR

TLP:CLEAR

KeyTakeaways

August2025

InitialAccessMethods*MostImpactedIndustries

•ExternalRemoteServices(20%)•Professional,Scientific,andTechnicalServices(27%)

•Phishing:Link(17%)•Manufacturing(16%)

•Phishing:Attachment(13%)•FinanceandInsurance(9%)

•ValidAccounts(13%)•HealthCareandSocialAssistance(8%)

•Phishing:Non-Technical(10%)•EducationalServices(8%)

TopRansomwareVariantsTopThreatIncidentTypes

•QILIN•EmailCompromise(40%)

•SINOBI•Ransomware(31%)

•NITROGEN•InsiderThreat(18%