Securitybrief.Co.Nz

389% Increase in Account Breaches Driven by Phishing Services in 2025

First seen 16 Jan 2026, 10:50 UTC • Securitybrief.Au

•32.7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

eSentire reported a significant rise in account compromises in 2025, with email-led intrusions linked to credential theft. The research, based on data from over 2,000 customers, indicated that account compromise constituted 55% of cyber attacks, marking a 389% increase compared to 2024.

How this analysis works

Attack Flow

17 entities, 60 inferred relationships (STIX 2.1).

Technique (4)

Malware
Phishing
Ransomware
Supply Chain Attack

Campaign (1)

CastleLoader Attacks

Malware (4)

CastleLoader
Shai Hulud
Shai Hulud Worm
Tycoon2FA

Affected Platform (1)

Microsoft 365

Threat Actor (5)

Akira
BlackBasta
Interlock
Ransomhub
Sinobi

Tool (2)

EvilProxy
Flowerstorm

Relationships

Akira uses CastleLoader
Akira uses Shai Hulud
Akira uses Shai Hulud Worm
Akira uses Tycoon2FA
BlackBasta uses CastleLoader
BlackBasta uses Shai Hulud
BlackBasta uses Shai Hulud Worm
BlackBasta uses Tycoon2FA
Interlock uses CastleLoader
Interlock uses Shai Hulud
Interlock uses Shai Hulud Worm
Interlock uses Tycoon2FA
Ransomhub uses CastleLoader
Ransomhub uses Shai Hulud
Ransomhub uses Shai Hulud Worm
Ransomhub uses Tycoon2FA
Sinobi uses CastleLoader
Sinobi uses Shai Hulud
Sinobi uses Shai Hulud Worm
Sinobi uses Tycoon2FA
Akira uses EvilProxy
Akira uses Flowerstorm
BlackBasta uses EvilProxy
BlackBasta uses Flowerstorm
Interlock uses EvilProxy
Interlock uses Flowerstorm
Ransomhub uses EvilProxy
Ransomhub uses Flowerstorm
Sinobi uses EvilProxy
Sinobi uses Flowerstorm
Akira uses Malware
Akira uses Phishing
Akira uses Ransomware
Akira uses Supply Chain Attack
BlackBasta uses Malware
BlackBasta uses Phishing
BlackBasta uses Ransomware
BlackBasta uses Supply Chain Attack
Interlock uses Malware
Interlock uses Phishing
Interlock uses Ransomware
Interlock uses Supply Chain Attack
Ransomhub uses Malware
Ransomhub uses Phishing
Ransomhub uses Ransomware
Ransomhub uses Supply Chain Attack
Sinobi uses Malware
Sinobi uses Phishing
Sinobi uses Ransomware
Sinobi uses Supply Chain Attack
CastleLoader Attacks attributed to Akira
CastleLoader Attacks attributed to BlackBasta
CastleLoader Attacks attributed to Interlock
CastleLoader Attacks attributed to Ransomhub
CastleLoader Attacks attributed to Sinobi
CastleLoader Attacks uses CastleLoader
CastleLoader Attacks uses Shai Hulud
CastleLoader Attacks uses Shai Hulud Worm
CastleLoader Attacks uses Tycoon2FA
Akira related to Microsoft 365

Continue Reading

Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million Persistent Firestarter Malware Targets Cisco Firepower Devices in US Agencies Exploitation of Remote Services in Cyber Attacks CVE-2024-40766 Exploited by Ransomware Groups Targeting SonicWall Firewalls Ransomware Group Targets SonicWall Gen 7 Firewalls via CVE-2024-40766

389% Increase in Account Breaches Driven by Phishing Services in 2025

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading