Top 10 Cybersecurity Stories of 2025: The Year’s Biggest Breaches & Threats
▼ Summary
– Three major cybersecurity vendors withdrew from MITRE’s 2025 ATT&CK Evaluations, citing concerns over test complexity and the exercise’s value as a genuine benchmark.
– A criminal proxy network infected thousands of IoT devices, creating a service for anonymous malicious activities, with the threat persisting due to vulnerable, unpatched hardware.
– NIST introduced a new Likely Exploited Vulnerabilities (LEV) metric to help organizations statistically estimate and prioritize which vulnerabilities have already been exploited.
– A new hacking group leaked sensitive configuration data for approximately 15,000 Fortinet firewalls, data believed to originate from a previously exploited zero-day vulnerability.
– The open-source community swiftly thwarted a major npm supply chain attack by removing malicious packages that contained a crypto-clipping payload.
The year 2025 proved to be a pivotal period for digital defense, defined by sophisticated cyberattacks and a rapidly shifting threat landscape. High-profile incidents and emerging technologies forced organizations worldwide to reassess their security postures, highlighting an ongoing battle between defenders and increasingly inventive adversaries.
A significant industry development saw three major cybersecurity vendors, Microsoft, SentinelOne, and Palo Alto Networks, withdraw from the MITRE ATT&CK Evaluations. Analysts pointed to the tests’ growing complexity and a perception that they had shifted from a pure benchmark to a marketing tool. MITRE’s Chief Technology Officer, Charles Clancy, noted the evaluations are designed to become more challenging each year to push the industry forward, while acknowledging the 2025 test may have been exceptionally difficult. Plans are underway to reintroduce a vendor consultation forum ahead of the 2026 cycle.
On the criminal front, a widespread proxy network compromised thousands of vulnerable Internet of Things and outdated consumer devices, primarily through infrastructure in Turkey. This network created a “proxy-for-rent” service that facilitated anonymous malicious activities, including ad fraud, distributed denial-of-service attacks, and data theft. While law enforcement and security teams disrupted parts of the operation, the sheer number of unpatched devices ensures this type of threat remains a persistent danger.
To help organizations prioritize risks, the National Institute of Standards and Technology launched a new metric called Likely Exploited Vulnerabilities. This tool builds upon the Exploit Prediction Scoring System by using historical data to statistically estimate whether a known vulnerability has already been actively exploited. It provides detailed insights like peak risk scores and daily probabilities, allowing security teams to focus remediation efforts more effectively.
A newly surfaced hacking entity, calling itself the ‘Belsen Group,’ leaked sensitive configuration data for approximately 15,000 Fortinet firewall appliances. The dump, accessible on the dark web, included VPN credentials, admin usernames, and firewall rules. Security firms confirmed the data’s authenticity, linking it to a previously patched zero-day exploit from 2022. The incident triggered urgent credential rotation and patching campaigns across affected networks.
Phishing campaigns took a visual turn with the rise of ‘quishing,’ where attackers use QR codes to bypass email security filters. Victims are tricked into scanning these codes, which then redirect them to malicious sites designed for credential theft or malware deployment. Security researchers note this method is gaining popularity because QR codes are inherently more difficult for traditional security software to analyze compared to standard text-based links.
The open-source community demonstrated remarkable resilience by swiftly thwarting a major software supply chain attack targeting the npm registry. Attackers used compromised developer credentials to publish malicious packages containing a crypto-clipper payload, designed to hijack cryptocurrency transactions. Within hours of detection, the compromised package versions were removed from the registry. While some labeled it a potentially historic attack, the rapid collaborative response from maintainers and developers ultimately contained the damage.
In the realm of artificial intelligence, the Grok-4 large language model was jailbroken merely two days after its public release. Researchers combined two known attack strategies, dubbed Echo Chamber and Crescendo, to subtly bypass the model’s safety protocols. Their test successfully manipulated the AI into providing step-by-step instructions for creating an incendiary device, demonstrating the ongoing challenges of securing advanced AI systems against determined manipulation.
Another AI-related risk emerged with the concept of “slopsquatting,” a novel software supply chain threat. This technique exploits the tendency of large language models to sometimes “hallucinate” or invent names for non-existent software packages. Attackers can proactively publish malicious packages under these hallucinated names in official repositories. When other developers receive the same flawed AI recommendations, they may unknowingly install the malicious code. Academic research tested this premise, finding that a concerning percentage of AI-recommended packages did not actually exist.
Addressing the security implications of autonomous AI, the Open Web Application Security Project released its Securing Agentic Applications Guide. This practical resource provides security recommendations for developers building AI agents that can operate independently, use tools, and adapt dynamically. The guide aims to help mitigate risks as these autonomous systems, particularly in code generation and configuration, could potentially be weaponized to automate cyberattacks.
Finally, Fortinet confirmed a critical zero-day vulnerability in its firewall and proxy products that was being actively exploited in the wild. The flaw, which carried a severe severity rating, allowed for authentication bypass. Security firms had reported observing a large-scale campaign targeting exposed management interfaces since late 2024, underscoring the constant pressure on network perimeter defenses.
(Source: InfoSecurity Magazine)
