If there’s one thing the industry can be certain of, it’s that cyberattacks will evolve in sophistication and scale. This is reflected in Arctic Wolf’s latest Incident Response (IR) Report, which paints a vivid – and frightening – picture of today’s threat landscape.

Based on hundreds of global forensic investigations from October 2023 to September 2024, the findings offer clear insights into the dominant attack types, industries at highest risk and the techniques attackers are using to bypass defences. Here’s what every company needs to know.

Ransomware: the king of cybercrime

Unsurprisingly, ransomware dominated the IR landscape, making up nearly half (44%) of all incidents during the reporting period. Although slightly down from 48.6% the year before, this scourge remains the preferred tactic for malicious actors, thanks to their lucrative payout potential as well as the opportunity for malefactors to take more than one bite of the apple.

Also, the rise of ransomware-as-a-service (RaaS) has dramatically lowered the barriers to entry, enabling even those with relatively low skill to reap the rewards of these tools. Now threat actors can simply rent ransomware tools and buy network access from initial access brokers, creating a crowded ecosystem with over 50 distinct threat groups observed in victim environments.

When it comes to who is in the crosshairs, the most heavily targeted industry was manufacturing with 18.6%, followed by healthcare at 13.1% and construction with 12%, and legal and government hot on its heels at 11.7%.

These sectors are popular targets because operational downtime is particularly damaging, disrupting production, risking regulatory penalties, exposing sensitive data and even threatening human life.

Notably, double extortion – encrypting data and exfiltrating it to apply additional pressure – has become the norm. In a whopping 96% of ransomware cases, bad actors stole data before deploying ransomware.

Despite the severity of attacks, only 30% of victims in Arctic Wolf’s dataset ended up paying a ransom, which is quite a contrast to prior surveys that suggested an 80% payment rate. Most payments were made to expedite recovery, not because they were strictly necessary.

Reduction in ransom demands

Interestingly, ransom negotiations seem to be paying off: Arctic Wolf’s negotiators achieved a 64% reduction in ransom demands on average, reinforcing the value of professional negotiation expertise in crisis situations.

The median initial ransom demand remained steady at US$600 000, suggesting a maturing ransomware market where attackers and defenders alike have adjusted their expectations.

BEC: following the money

While ransomware grabs headlines, business e-mail compromise (BEC) is an equally significant threat, especially for industries that move money.

The finance and insurance sector bore the brunt, accounting for more than a quarter (26.5%) of BEC IR cases, nearly double that of the next highest industries (legal and government at 13.3%). In these sectors, BEC was the root cause of 53% of incidents, surpassing even ransomware – a unique finding among industries surveyed.

Clearly, any entity that regularly exchanges payment instructions via e-mail will be of interest to BEC scammers.

Low-tech tactics

The report also found that malefactors are leaning heavily on simple tactics like phishing, unsecured Remote Desktop Protocol (RDP) and compromised VPN credentials to gain initial access. After all, why break down the front door when you can just find an unlocked window?

RDP alone accounted for 38% of ransomware IR cases.

These “low-tech” methods remain effective because many firms still have weak access controls. Arctic Wolf stressed the critical role of phishing-resistant multifactor authentication (MFA) to protect against credential-based intrusions.

The lesson? Even the most sophisticated security tools can’t compensate for fundamental weaknesses in identity and access management.

Focus on what matters

Patch management often feels like a never-ending game of Whac-A-Mole, but Arctic Wolf’s findings suggest that strategic prioritisation can seriously blunt an attacker’s efforts.

In more than three-quarters (76%) of intrusion cases, the threat actors exploited one of just 10 known vulnerabilities, most linked to remote access tools. Importantly, none were zero-days – meaning they were all known issues that could have been patched in advance.

Companies should prioritise patching based on:

CVE severity
Location of critical data
Exposure of edge devices like VPNs and firewalls

Understanding where your most sensitive data lives – and how bad actors could reach it – is at the heart of any defensible patching strategy.

Zero-days: reserved for stealth missions

Although the spectre of zero-day vulnerabilities looms large in cybersecurity discussions, Arctic Wolf found they were rare in ransomware (0.4%) and BEC (0%) cases. However, zero-days did account for 6% of intrusion incidents, suggesting that threat actors reserve these costly, stealthy tactics for high-value espionage or data theft operations, not broad-based attacks.

Important truths

Arctic Wolf’s 2024-2025 IR Report highlights several important truths about today’s cybercrime landscape:

Ransomware is evolving, but it’s not going away. Double extortion is now standard practice.
BEC is thriving in sectors where money movement is key – finance, insurance, legal and government.
Low-tech initial access methods like phishing and RDP exploitation are still highly popular.
Vulnerability management needs smart prioritisation, not just speed.
Zero-days are rare and are reserved for high-value targets.

Ultimately, the report brings home how cybersecurity goes beyond having the latest technologies; it’s about getting the basics right – securing remote access, enforcing strong MFA, patching strategically and preparing for rapid, expert-driven response when things go wrong.

For entities seeking to protect themselves, the takeaway is clear: prevention is key, but preparation is everything. Read the full report from Arctic Wolf here.