CYBERSTATS

Security Intelligence

VendorsReliaQuest

ReliaQuest

Cybersecurity reports and statistics published by ReliaQuest

8 categories5 reports

Research Reports

Reports and publications from ReliaQuest

Too Much Trust: The Danger of Over-Privileged Cloud Identities

Ransomware and Cyber Extortion in Q2 2025

Annual Cyber-Threat Report

Ransomware and Cyber Extortion in Q4 2024

Racing the Clock: Outpacing Accelerating Attacks

Recent Statistics & Reports

Q2 2025 saw a 31% decrease in named ransomware victims compared to the previous quarter, marking a return to more typical levels.

In Q1 2025, Clop named 389 victims on its data-leak site in February alone.

SafePay's activity increased by 42% in Q2 2025 compared to Q1 2025.

RansomwareSafePay

The US remained the most targeted country by ransomware, accounting for 67% of the total organizations named on ransomware data-leak sites in Q2.

RansomwareUSData leak site

Two-thirds of critical hands-on-keyboard incidents involved legitimate software like remote access tools last year.

Compromised service accounts were present in 85% of breaches last year.

80% of ransomware attacks in the last year focused on data exfiltration only.

After initial access, "breakout time" typically takes just 48 minutes, with some groups achieving lateral movement in as little as 27 minutes.

A quarter of active intrusions started with exploitation of public-facing applications.

Exfiltration-only ransomware attacks are 34% faster than those involving encryption.

70% of the domains egistered by Scattered Spider imitated a specific organisation.

20–25% of Scattered Spider domains targeted finance and insurance companies.

25–30% of Scattered Spider domains targeted manufacturing companies.

The fastest recorded lateral movement occurred in just 27 minutes.

Roughly 20% of the domains registered by Scattered Spider imitated Gateway and Network Infrastructure.

Only a small fraction (0.02%) of alerts led to lateral movement, meaning attacks are getting faster.

LockBit's victim count decreased from 176 in May 2024 to only five in December.

Initial access listings on cybercriminal platforms surged by 142% in the same period.

66% of customer ransomware incidents in 2024 involved initial access likely purchased from an IAB.

Approximately 15% of domains registered by Scattered Spider imitated VPN and Secure Access.

Showing 21-40 of 62 results

Top Categories

6

Identity Management

4

4

3

Vulnerabilities

2

2

Security alerts

Related Vendors

Beazley Security

GuidePoint Security

Cisco Talos Blog