Monday Morning Impact – September 1

Acronis, a Swiss cybersecurity company, has released a new report detailing the most popular threat vectors, active threat groups, and targeted industries in the first half of 2025. Ransomware remains the major threat for large and medium-sized businesses, with new groups increasingly leveraging AI to automate their activities – phishing accounted for 25% of all attacks and 52% of attacks targeting MSPs, a 22% increase compared to 1H 2024.

The number of publicly known ransomware victims increased nearly 70% over the measured time period, as compared to both 2023 and 2024. Cl0p, Akira, and Qlin are the most active ransomware gangs. Ransomware gangs are increasingly utilizing AI, and this is reflected in their chosen threat vectors – social engineering and Business Email Compromise (BEC) attacks increased from 20% to 25.6% in January 2025 through May 2025 compared to the same period in 2024, likely due to the growth in AI use for crafting convincing impersonations. Malware was discovered in 1.47% of Microsoft 365 email backups.

While the overall number of attacks targeting MSPs fell over the measured time period, the nature of attacks changed significantly; phishing accounted for 52% of all attacks targeting MSPs as compared to 30% in 2024, while Remote Desktop Protocol (RDP) attacks all but vanished.

While phishing is the weapon of choice for attackers, they are increasingly focusing on collaboration apps, eschewing simple BEC campaigns. Almost 25% of the attacks in collaboration apps leveraged AI-generated deepfakes or automated exploits.

Manufacturing was ransomware gangs’ most targeted industry, representing 15% of all recorded cases in Q1 2025. Retail, food and drink (12%) and telcos and media (10%) were also popular targets.

“While the endgame for cybercriminals is still ransomware, how they get there is changing,” said Gerald Beuchelt, CISO at Acronis. “Even the least sophisticated attackers today have access to advanced AI capabilities, generating social engineering attacks and automating their activities with minimal effort. The result is that MSPs, manufacturers, ISPs, and others are constantly exposed to sophisticated attacks, including increasingly advanced deepfakes, and all it takes is one mistake to put the organizations’ entire future at risk.”

The biannual report covers the global threat landscape as encountered by the Acronis Threat Research Unit (TRU) and Acronis sensors on Windows endpoints from January through June 2025. Based on signals from over 1,000,000 unique endpoints distributed around the world, the report also incorporates statistics focused on threats targeting Windows operating systems, given their prevalence as compared to macOS and Linux.

Channel Impact^®
Ransomware remains the top threat to large and midsized businesses as most active groups are increasingly leveraging AI for low-effort, high-reward campaigns. Channel partners who can effectively address these threats are faced with huge opportunities, as well as challenges.

Zscaler, Inc., a San Jose, California-based cloud security company, announced an expanded partnership between Red Canary, a Zscaler company, and strategic partner CrowdStrike to deliver enhanced protection across endpoints, users, and workloads. The alliance is intended to facilitate a seamless path for customers migrating to CrowdStrike’s Falcon platform. The combination of the Zscaler Zero Trust Exchange platform, the AI-native CrowdStrike Falcon platform, and Red Canary’s agentic-AI driven security operations platform promises a multi-layered defense against threats.

“Zscaler and CrowdStrike share a vision to enable secure digital transformation with uncompromising protection across every layer of the enterprise,” said Raj Judge, Board Member and EVP of Corporate Strategy at Zscaler. “By expanding our partnership with CrowdStrike through Red Canary, we are accelerating security operations with advanced AI-powered automation, best-of-breed technologies, and a shared commitment to putting our customers first.”

“Organizations are moving away from legacy, point product endpoint vendors in search of platform outcomes and elite protection,” said Daniel Bernard, Chief Business Officer at CrowdStrike. “By expanding our partnership with Red Canary and Zscaler, we’re delivering world-class security operations powered by the Falcon platform, Red Canary’s agentic-AI managed endpoint expertise, and Zscaler’s cloud-native zero trust capabilities. Together, we’re helping customers standardize their security architectures, stopping breaches with real-time threat detection, lightning-fast response, and the confidence that comes with the AI-native Falcon platform.”

Channel Impact^®
This collaboration promises greater flexibility and control, helping customers optimize security investments and empowering partners to deliver robust managed SOC services.