Webinar Replay: Q4 2024 Cyber Threat Landscape - Gone Phishing. Evolving Techniques Keep Organizations on the Hook

Name: Webinar Replay: Q4 2024 Cyber Threat Landscape - Gone Phishing. Evolving Techniques Keep Organizations on the Hook
Start: 2025-02-26

February 26, 2025

Our quarterly threat landscape reports are fueled by frontline incident response intel and elite analysts.

Webinar Replay: Q4 2024 Cyber Threat Landscape - Gone Phishing. Evolving Techniques Keep Organizations on the Hook

Trends observed by Kroll in Q4 confirm that 2024 was a year of fragmentation and fast-moving evolution for cyber threats, and they suggest that 2025 is likely to be similar. A key trend was the ongoing development of phishing techniques and approaches. Aligning with trends from last year and previous years, professional services stands out as 2024’s most targeted sector. However, patterns for other sectors are also concerning, with manufacturing remaining a firm favorite as a target for attackers.

During the session, our experts—Keith Wojcieszek, Laurie Iacono and George Glass—explore key trends and provide insights drawn from thousands of cyber incidents handled worldwide each year. They also address the issues that organizations should be aware of, including notable threat incidents and active ransomware groups.

The briefing covers:

Notable themes and patterns defining the threat landscape, such as an increase in phishing attacks
The continuing rise of nation-state activity
Critical shifts in attacker behavior, for example, the ongoing evolution of ransomware methods
The escalation of threats to perimeter/edge devices
Specific steps your organization can take to stay secure in the year ahead

Key Sections From the Webinar

The Year of the Infostealer

“2024 is the year of the infostealer. I’ve certainly never seen anything quite like it, especially in the second half of 2024 when infostealers were rife. There’s been an incredible amount of development in the infostealer ecosphere. I don’t think that’s going to slow down in 2025.” – George Glass

Here, our CTI experts dive into the key trends and security incidents that defined 2024 and how they could impact the 2025 security landscape, looking at the impact of activity associated with nation-states, ransomware and AI. While the use of information stealers already posed a notable threat, activity observed in 2024 and in early 2025 suggests this trend is likely to continue. The team discusses these and other notable themes shaping the threat landscape. Watch now to learn more.

Threat Actors Pivot Fast

“Another critical topic for 2024 was the use of vulnerabilities by threat actors – how quick they are to pivot onto new or novel zero day or end day vulnerabilities. Threat groups are adept at quickly reacting to proof of concept exploits that appear on the web or developing their own, in the case of CLOP, and I see that continuing well into 2025 and beyond.” – George Glass

Here, our experts discuss how threat actors have swiftly and successfully leveraged a wide array of vulnerabilities to achieve their goals. From vulnerabilities in FortiOS, to the CLEO software attack by CLOP, to BLACKCAT targeting SonicWall devices, threat actors show no sign of slowing down in their efforts to take advantage of vulnerabilities. Watch now.

2024 Sector Analysis

“The number one sector under attack according to our findings is professional services, with incidents impacting companies such as law, insurance, accounting, real estate and consulting firms. We see these types of businesses targeted frequently, typically with email compromise.” – Laurie Iacono

Here, the team outlines the top five sectors that were mostly under attack by threat actors in 2024. Professional services takes the top spot, with more than a quarter of Kroll cases relating to firms in this space. From the impact on professional services and other sectors—including manufacturing, technology and healthcare—to specific types of attack and what makes these industries attractive to threat actors, watch now to learn more.

Initial Access Efforts Diversify

“Phishing, valid accounts, social engineering and external remote services: these four aspects are closely linked, highlighting threat actors’ efforts in going after credentials. We’ve also seen actors use social engineering to prime users give up their credentials. Identity access management is very important for organizations.” – Laurie Iacono

Here, our experts outline the interconnected nature of initial access methods, with phishing as the top choice for threat actors. Cybercriminals continue to leverage vulnerabilities at great speed, putting organizations under continued pressure to act fast before opportunistic exploitation begins. To hear about this and the key actions organizations should take to defend against the use of vulnerabilities, watch now.

Infostealers Remain Prominent

“Our findings highlight the huge and significant threat that information stealers present. The ecosystem is rapidly evolving. Some of these stealers are getting updates once or twice a month. It really is a cat and mouse game when it comes to information stealers.” – George Glass

Drawing on insights gleaned from deeper investigations, our managed detection and response business and our monitoring of the threat landscape through some of our proprietary threat intelligence methods, our CTI experts provide an overview of the most prominent malware threats of 2024 and those emerging in 2025. Watch now for an insight into key malware trends, including major players and newly emerging pioneers.

The Evolving Phishing Threat

“Just as the infostealer market is hotting up, so is the actor-in-the-middle or the phishing-as-a-service platform market. We’ve seen many platforms this year, all of them jostling for position. It’s a very active marketplace and something we’re keeping a very close eye on.” – George Glass

Here, our experts outline how the phishing threat continues to evolve, with a look at the increase in “lone wolf” actors, an exploration of phishing tactics—including the growing use of QR codes and AI tools—plus an uptick in telephone-oriented attack delivery (TOAD) callback phishing schemes and a highly active phishing-as-a-service platform market. For these and other key findings, plus a deep dive into a case study of a related form of attack through the use of email “bombing”, watch now.

Stay Vigilant

“I think when you see how quickly these tactics pop up, like email bombing, and how widespread they become, you can see the speed that threat actors are working at, so it’s really important to have regular cybersecurity training sessions and also to have a way for users to actually report threats.” – Laurie Iacono

With so many changes in threat actor behavior observed in Q4, is your organization prepared? Having handled thousands of incident response cases, our experts share the key steps to take to ensure you achieve and maintain cyber resilience amid constantly evolving cyber threats. Watch now.

Connect With Us

George Glass

Associate Managing Director

Cyber and Data Resilience

London

+44 2071478785 George Glass

Keith Wojcieszek

Global Head of Threat Intelligence

Cyber and Data Resilience

Washington DC

+1 443 295 5082 Keith Wojcieszek

Stay Ahead with Kroll

Cyber and Data Resilience

Incident response, digital forensics, breach notification, security strategy, managed security services, discovery solutions, security transformation.

Cyber and Data Resilience

Kroll Responder MDR

Stop cyberattacks. Kroll Responder managed detection and response is fueled by seasoned IR experts and frontline threat intelligence to deliver unrivaled response.

Kroll Responder MDR

Computer Forensics

Kroll's computer forensics experts ensure that no digital evidence is overlooked and assist at any stage of an investigation or litigation, regardless of the number or location of data sources.

Computer Forensics

24x7 Incident Response

Kroll is the largest global IR provider with experienced responders who can handle the entire security incident lifecycle.

24x7 Incident Response

Cyber Risk Retainer

Kroll delivers more than a typical incident response retainer—secure a true cyber risk retainer with elite digital forensics and incident response capabilities and maximum flexibility for proactive and notification services.

Cyber Risk Retainer

Malware Analysis and Reverse Engineering

Kroll’s Malware Analysis and Reverse Engineering team draws from decades of private and public-sector experience, across all industries, to deliver actionable findings through in-depth technical analysis of benign and malicious code.

Malware Analysis and Reverse Engineering

Ransomware Preparedness Assessment

Kroll’s ransomware preparedness assessment helps your organization avoid ransomware attacks by examining 14 crucial security areas and attack vectors.

Ransomware Preparedness Assessment