Cyber Trends Report
In today’s fast-paced and hyperconnected world, cyber risks are no longer just an IT concern, they are a fundamental business risk. The stakes are high: reputation, operations, customer trust, and financial stability are all on the line. As the threat landscape continues to evolve, businesses need to be agile in how they anticipate, detect, and respond.
At TD, we are more than a financial partner—we are committed to supporting your organization's efforts to become more resilient and secure. To deliver on that commitment, we have developed this Cyber Trends Report with you in mind. It serves as a practical, insight-rich resource designed to help you better understand potential risks and make informed decisions in an increasingly complex digital environment.
In this report, you will find highlights of key cyber threats and trends we have observed, from the growing use of AI by malicious actors to sophisticated phishing campaigns, ransomware tactics, and sector-specific vulnerabilities. You will also find actionable insights and best practices that can help strengthen your organization’s cyber readiness.
Whether you are looking to enhance your internal defenses, educate your teams, or simply stay ahead of what’s , we trust that this report offers timely value to sharpen your strategy.
Together, we can build a more secure digital future.
What’s New: Generative AI is fueling a wave of hyper-personalized scams and business email compromise (BEC). Deepfake technology is now used to impersonate executives in video calls, with one real-world case involving a $25 million loss via a fake CFO Zoom call.
Industry Insight : GenAI is helping threat actors scale operations and launch attacks in multiple languages, bypassing traditional email filters and evading user suspicion. The report notes the emergence of "scams-as-a-service" using GenAI.
Actions for Commercial Clients:
What’s New: Threat actors increasingly exploit critical software components and managed file transfer (MFT) platforms. High-profile vulnerabilities in MOVEit, Cleo, and XZ Utils led to mass data exposure across sectors.
Industry Insight: A breach in a single shared vendor can ripple across dozens of firms. Diversifying vendors may reduce concentration risk but can also introduce less mature partners.
Actions for Commercial Clients:
What’s New: In 2024, the number of attacks declined, but ransom demands reach historic highs—including a record $75 million payout. Ransom-as-a-Service (RaaS) continues to become more professionalized, employing double and triple extortion tactics.
Industry Insight: Financial services, healthcare, government (municipalities) and the education sector remain among the top targets for ransomware operators. RaaS operators quickly rebrand to evade law enforcement and sanctions.
Actions for Commercial Clients:
Distributed Denial-of-Service (DDoS) Attacks Surge Amid Geopolitical Tensions
What’s New: DDoS attacks are increasingly used to disrupt services and distract from more damaging intrusions. Campaigns linked to hacktivists surged around geopolitical flashpoints, impacting firms in APAC, EMEA, and North America.
Industry Insight: Financial services was the most targeted sector for DDoS in 2024, accounting for 34% of attacks (Akamai).
Actions for Commercial Clients:
What’s New: Employees are experimenting with GenAI without oversight (“shadow AI”), exposing firms to data leakage and IP loss. Meanwhile, threat actors use Large Language Models (LLMs)—advanced artificial intelligence tools—to produce convincing phishing emails and malicious code.
Industry Insight: Threat actors aren’t yet using GenAI to discover novel vulnerabilities, but they’re accelerating attack cycles with more polish and scale. AI governance and internal education are now critical.
Actions for Commercial Clients:
What’s New: With new quantum chip advancements from Microsoft and Amazon, the risk of current encryption becoming obsolete is real. Threat actors are already harvesting encrypted data to decrypt later.
Industry Insight: Firms that delay quantum readiness risk significant exposure. Post-quantum cryptography (PQC) migration may take years.
Actions for Commercial Clients:
What’s New: Attacks from groups affiliated with China, Russia, Iran, and North Korea are expanding. Financial institutions are often indirect targets due to their dependence on third-party tech or geopolitical positioning.
Industry Insight: North Korean threat actors stole $2.2B in cryptocurrency in 2024 and infiltrated Western financial firms by posing as IT workers. Volt Typhoon (China) and Midnight Blizzard (Russia) conduct pre-positioning campaigns.
Actions for Commercial Clients: