2025年全球事件响应报告

Table of ContentsExecutive Summary.....................................................................................................................................................1.Introduction..............................................................................................................................................................2.Emerging Threats and Trends..........................................................................................................................Trend 1.Disrupting Business Operations: The Third Wave of Extortion Attacks.............................................................6Trend 2.Increasing Impact in Software Supply Chain and Cloud Attacks....................................................................10Trend 3.Speed: Attacks are Getting Faster, Giving Defenders Less Time to Respond.............................................13Trend 4.The Rise of Insider Threats: North Korea’s Insider Threat Spree........................................................................15Trend 5. The Emergence of AI-assisted Attacks.........................................................................................................................163.How Threat Actors Succeed: Common Effective Tactics, Techniques and Procedures.......3.1.Intrusion: Growing Social Engineering, Both Widespread and Targeted................................................................193.2.Attack Technique Insights From Unit 42 Case Data........................................................................................................204.Recommendations for Defenders.................................................................................................................4.1.Common Contributing Factors..................................................................................................................................................234.2.Recommendations for Defenders.............................................................................................................................................245.Appendix: MITRE ATT&CK®Techniques by Tactic, Investigation Typesand Other Case Data..........................................................................................................................................5.1Overview of Observed MITRE Techniques by Tactic.......................................................................................................275.2.Data by Region and Industry.......................................................................................................................................................326.Data and Methodology......................................................................................................................................Contributors..............................................................................................................................................................................................37 2Global Incident Response Report 202534618232737 Executive SummaryWe see five major emerging trends reshaping the threat landscape.•●First, threat actors are augmenting traditional ransomware and extortion withattacks designed to intentionally disrupt operations. In 2024, 86% of incidentsthat Unit 42 responded to involved business disruption — spanning operationaldowntime, reputational damage or both.•Second, software supply chain and cloud attacks are growing in both frequencyand sophistication. In the cloud, threat actors often embed within misconfiguredenvironments to scan vast networks for valuable data. In one campaign, attackersscanned more than 230 million unique targets for sensitive information.•Third, the increasing speed of intrusions — amplified by automation andstreamlined hacker toolkits — gives defenders minimal time to detect and respond.In nearly one in five cases, data exfiltration took place within the first hour ofcompromise.•Fourth, organizations face an elevated risk of insider threats, as nation-states likeNorth Korea target organizations to steal information and fund national initiatives.Insider threat cases tied to North Korea tripled in 2024.•Fifth, early observations of AI-assisted attacks show how AI can amplify the scaleand speed of intrusions.Amid these trends, we’re also seeing a multi-pronged approach in attacks, as threatactors target multiple areas of the attack surface. In fact, 70% of the incidents Unit 42responded to happened on three or more fronts, underscoring the need to protectendpoints, networks, cloud environments and the human factor in tandem. And on thehuman element — nearly half of the security incidents (44%) we investigated involved aweb browser, including phishing attacks, malicious redirects and malware downloads.Drawing from thousands of incident responses over years of experience, we’ve identifiedthree core enablers that allow adversaries to succeed:complexity, gaps in visibilityand exc