CERT annual report 2025: the cyber threat review

In 2025, the nature of the cyber threat changed: it no longer strikes in peaks, it settles in. Throughout the year, the number of ransomware victims stayed above 2023 and 2024 levels, with no real return to normal. Our 2025 annual CERT report takes stock of this pressure that has become permanent.

For an MSP, this changes the game. Cybercriminal groups have reached a level of industrialisation that allows them to sustain regular, quieter and more targeted campaigns. As a result, an organisation’s size, sector or location no longer protects it.

That is why our CERT team has consolidated a full year of cases actually handled in order to draw concrete lessons from them. Discover in this 2025 annual CERT report the key figures, the dominant groups and the four operational lessons to remember.

A ransomware threat that is now permanent

Data from ransomware.live confirms a structural trend: in 2025, the volume of victims stayed durably above the previous two years, including during periods that are usually quieter. In other words, the pressure no longer eases.

This continuity is explained by the rise of the Ransomware-as-a-Service (RaaS) model. For example, the Qilin group established itself as the dominant platform: with more than 1,000 victims claimed over the year, it accounted for nearly 29% of global ransomware attack volume. Alongside it, Akira and Clop complete a trio that industrialises its campaigns through networks of affiliates.

In Europe, France, Germany and the United Kingdom remain exposed throughout the year. In addition, the French economic fabric is also hit by more opportunistic, regional actors, which makes the threat hard to anticipate.

The 4 lessons from the Cyna CERT in 2025

Beyond the numbers, our 2025 annual CERT report draws four lessons from the incidents our analysts handled in the field:

1. Identity, the number one entry vector. Attackers no longer exploit a vulnerability, they log in with a valid identifier (targeted phishing, stolen credentials, infostealers). In concrete terms, the Cyna SOC detects one compromised mailbox per day.
2. Silent persistence. Before acting, the attacker quietly settles in: Azure application consent, webshell drops, slow exfiltration. The aggravating factor remains the lack of logging, which leaves detection blind.
3. Hijacked trust. The most effective attacks use legitimate channels. For instance, a SharePoint share sent from a compromised mailbox defeats conventional anti-phishing filters.
4. Industrialisation through AI. Artificial intelligence lowers the barrier to entry: flawless phishing lures, mass scanning, automated compromise. As a result, defence must follow the same logic, with behavioural detection and automated response.

What you will find in the 2025 annual CERT report

• Foreword by Nathan Bramli, co-founder and Head of Cyber at Cyna
• Overview of 2025 trends: volumes, countries and sectors targeted
• The most active ransomware groups worldwide and in France
• The 4 lessons drawn from the incidents handled by our CERT

Download the 2025 annual CERT report

Want to turn these findings into concrete actions for your clients? This 2025 annual CERT report gives you the full read, sector by sector, with the operational insight of the analysts at our managed SOC for MSPs. Download it for free below.