India among targets as China-linked hackers 'exploit' VPNs, firewalls

Cyberattackers grew faster and harder to detect in 2025, increasingly slipping through trusted systems rather than breaking in with obvious malware, claims U.S.-based  cybersecurity technology company CrowdStrike's 2026 Global Threat Report.

The report says adversaries "grew more evasive than ever before," exploiting trust in supply chain partners, legitimate software, internal systems and employees. CrowdStrike now tracks 281 adversaries after naming 24 new ones in 2025, plus 150 activity clusters and emerging threat groups.

The average time for criminal intruders to move from their first foothold to other systems, known as breakout time, fell to 29 minutes, 65% faster than in 2024. The fastest breakout took just 27 seconds. Breakout time has dropped roughly 70% since 2021, when it averaged 98 minutes. In one case, a group called CHATTY SPIDER tricked an employee at a U.S. law firm into granting remote access through Microsoft Quick Assist. Within four minutes it tried to steal data. When a firewall blocked that attempt, it switched to Google Drive. CrowdStrike's OverWatch team detected the activity before the theft was completed.

CrowdStrike says 82% of detections in 2025 were malware-free, up from 51% in 2020. Attackers increasingly used valid credentials, trusted identity flows and approved software integrations, so that intrusions blended "into normal activity." The company also reported a 563% rise in fake CAPTCHA lures used to trick victims into running malware.

Attacks by AI-enabled adversaries rose 89% year over year. Threat actors used AI for phishing, reconnaissance, malware development and information operations. The North Korea-linked group FAMOUS CHOLLIMA used AI tools to create fake personas and perform jobs in fraudulent employment schemes, and the Russia-linked FANCY BEAR deployed malware called LAMEHUG that queried a language model to generate commands. The report is cautious, however. It says AI's impact "primarily enhances established" tactics rather than creating new attack methods, and that LAMEHUG showed no meaningful gain in effectiveness over traditional malware.

AI systems themselves were also targeted. Attackers exploited a flaw in the Langflow AI platform to deploy ransomware, published a malicious clone of an email-related AI server that forwarded users' mail to attackers, and hid prompt-injection text in phishing emails to confuse AI email triage. In one supply chain attack, malicious packages abused victims' own local AI command-line tools to generate commands for stealing credentials and cryptocurrency. CrowdStrike also cited evidence that some actors have run operations using agentic AI tools requiring minimal human oversight, though not at scale.

Big game hunting ransomware groups remained the main criminal threat. PUNK SPIDER was the most active, with 198 intrusions, up 134%. It often encrypts files remotely over network shares so ransomware never runs on monitored machines. SCATTERED SPIDER relied on social engineering of help desk staff to reset passwords, then mounted a domain controller's virtual disk on an unmanaged virtual machine to copy the Active Directory database. In one incident this took three hours, during which the attacker touched only one managed endpoint. CrowdStrike says BLOCKADE SPIDER used similar cross-domain methods.

Activity by China-linked adversaries rose 38%, with attacks on logistics up 85%, telecommunications up 30% and financial services up 20%. The groups favored edge devices such as VPNs and firewalls, which accounted for 40% of exploited vulnerabilities. They often moved within days of public disclosure, for instance exploiting the React2Shell flaw two days after it was revealed. One group, WARP PANDA, kept access to a victim for 22 months. CrowdStrike advises patching edge devices within 72 hours of critical vulnerability disclosure.

For India, the report has no dedicated section, but several findings bear directly on Indian organizations. India is named among the countries targeted by the China-linked group HOLLOW PANDA, which compromised Check Point VPN appliances in intrusions across Australia, Brazil, India, Indonesia, Israel, Mexico, the Philippines, Southeast Asia and the U.S. between mid-2023 and October 2025. The report adds that China-linked actors "continued to heavily focus their operations on the Asia Pacific region," with multiple groups targeting organizations in India among others. A malicious Notepad++ update delivered spyware to organizations in South Asia, a reminder that trusted software updates can be a route in. Sectors the report flags as high-risk, including telecommunications, logistics, financial services and technology, are central to India's economy, and the logistics and telecom increases cited above are global figures that Indian firms in those fields should read as relevant. The emphasis on unpatched VPNs and firewalls, fast-weaponized vulnerabilities and attacks that use valid credentials suggests that Indian enterprises, particularly large IT services and outsourcing firms whose access to client systems makes them attractive upstream targets, would face the same pressure to patch quickly, tighten identity controls and watch for trusted-channel abuse. These are inferences from the report's findings rather than conclusions CrowdStrike draws about India.

North Korea's PRESSURE CHOLLIMA stole cryptocurrency then valued at 1.46 billion dollars from the exchange Bybit by compromising a software wallet provider, which the report calls the largest cryptocurrency theft in history. A November npm attack compromised 690 packages to spread the self-propagating stealer ShaiHulud. Zero-day vulnerabilities exploited before public disclosure rose 42%.

Cloud-conscious intrusions rose 37%, including a 266% jump among state-linked actors. Valid account abuse accounted for 35% of cloud incidents. Russia-linked COZY BEAR sent victims to genuine Microsoft login pages, removing the usual warning sign of a suspicious domain.

CrowdStrike urges organizations to secure AI systems, treat identity and SaaS as primary attack surfaces, eliminate blind spots across security tools, protect software supply chains, prioritize edge device patching, invest in proactive threat hunting, and strengthen employee and team readiness through exercises. It notes that when attacks unfold in minutes, "reactive defense is no longer enough."

The report is published by a vendor that sells security products, and it closes with a catalog of its own offerings.