Monthly Threat Intelligence Report | June 2025

Executive Summary - June 2025

Overview

The cyberthreat landscape continues to evolve at an unprecedented pace, with email-based attacks increasing by 17.3% between September 2024 and February 2025 [1]. Organisations face a perfect storm of AI-enhanced threats, sophisticated social engineering campaigns, and targeted industry-specific attacks that are bypassing traditional security measures with alarming frequency [2].

Global cybercrime costs are projected to reach $10.5 trillion annually by 2025, representing a dramatic increase from $3 trillion in 2015 [3]. This escalation is driven by the democratisation of AI tools, the expansion of attack surfaces through remote work and cloud adoption, and increasingly sophisticated threat actor capabilities [3].

Key Threat Indicators:
• 82.6% of all phishing emails now exhibit some use of AI [4]
• 22.6% increase in ransomware payloads delivered through email attacks [1]
• 57.9% increase in attacks from compromised accounts [1]
• 2% of all phishing attacks include QR codes, representing a 1400% increase since 2021 [5]
• Advanced email attacks on financial services rose 25.2% year-over-year [6]

Emerging Threat Analysis

AI-Powered Attack Evolution

The integration of artificial intelligence into cybercriminal operations has fundamentally transformed the threat landscape [7]. AI-powered polymorphic phishing campaigns are now present in 76.4% of all phishing attacks, with 90.9% of polymorphic emails showing AI usage [1]. These campaigns create nearly identical emails that differ only by small details, making them extremely difficult for traditional signature-based detection systems to identify [1].

Generative AI tools enable cybercriminals to craft thousands of highly convincing phishing emails in minutes, often personalised to each victim using data harvested from social media, corporate websites, and previous breaches [8]. The sophistication has reached levels where 70% of adults are unsure of their ability to distinguish AI-cloned voices from authentic communications [9].

Quishing: The QR Code Threat Revolution

QR code phishing, or "quishing," has emerged as a dominant attack vector, with QR code redemptions projected to hit 5.3 billion in 2025 [5]. This represents 5.3 billion opportunities for cybercriminals to exploit unsuspecting users through malicious codes that bypass traditional email security measures [5].

Nearly 2% of all scanned QR codes are now malicious, highlighting the scale of this emerging threat [10]. Attackers are employing increasingly sophisticated techniques including coloured backgrounds to evade detection, password-protected attachments, and macro-enabled files that assemble malicious URLs dynamically [5].

The UK's Action Fraud received nearly 1,400 reports of quishing in 2024 alone, representing a massive jump from just 100 reports in 2019 [11]. Criminal organisations are targeting high-traffic areas like car parks and restaurants, placing fake QR codes over legitimate signage [11].

Deepfake and Voice Spoofing Proliferation

Voice-based deepfakes have reached remarkable sophistication levels, with cybercriminals able to capture voice samples from interviews, podcasts, or social media clips and generate convincing audio impersonations [9]. One in four adults has experienced or knows someone affected by an AI voice cloning scam [9].

Financial institutions are particularly vulnerable, with attackers using deepfake technology to impersonate executives or trusted clients for fraudulent wire transfers [12]. A recent case involved a major bank being defrauded of £35 million through a cloned voice of a trusted client [8].

Industry-Specific Risk Assessment

Financial Services Under Siege

The financial services sector faces unprecedented targeting, with advanced email attacks rising 25.2% year-over-year [6]. Phishing attacks on financial institutions increased by 17.1% between April 2024 and April 2025 [6]. The sector's susceptibility stems from handling massive volumes of sensitive data, processing billions in daily transactions, and managing extensive high-net-worth client networks [6].

Business Email Compromise attacks have caused over £43 billion in losses between 2013 and 2021, with individual incidents averaging £75,000 in damages [13]. Research shows a 30% increase in BEC attacks as of March 2025, making them the second most expensive type of breach at £4.89 million average cost [13].

Healthcare Vulnerabilities Intensify

The healthcare sector continues to face formidable cybersecurity challenges, with ransomware leading the charge against critical healthcare infrastructure [14]. Nation-state actors have intensified cyber-espionage efforts, targeting sensitive patient data and valuable intellectual property [14]. The proliferation of Internet of Medical Things (IoMT) devices has introduced new vulnerability vectors requiring urgent security adaptations [14].

Healthcare organisations struggle with legacy systems, unmonitored operational technology, and weak supply chains that cybercriminals exploit to cripple production lines and steal critical data [14]. The sector's reliance on third-party vendors introduces additional cascading vulnerabilities when external system breaches occur [14].

Manufacturing Industry at Risk

The manufacturing sector is embracing Industry 4.0 and IT/OT convergence, but this evolution creates new attack opportunities for cybercriminals [15]. Legacy systems, unmonitored OT, and weak supply chains are primary targets for attacks designed to halt production lines and steal intellectual property [15].

Key vulnerabilities include unmanaged systems, security blind spots, legacy vulnerabilities, weak segmentation, and poor monitoring of industrial environments [15]. Attackers increasingly exploit web shells, stolen credentials, and phishing tactics to establish long-term access before escalating their operations [15].

Government Sector Defences Outpaced

Government defences have not kept up with the severe and rapidly evolving cyber threat, with hostile states and criminals developing capabilities faster than anticipated [16]. Risky legacy IT systems comprise 28% of the public sector's IT estate, with substantial gaps remaining in understanding the estate's resilience to attack [16].

By January 2025, 319 legacy systems had been identified across government, with approximately 25% rated as having high likelihood and impact of risks occurring [16]. However, government does not know the total number of legacy systems in use, highlighting significant visibility gaps [16].

Attack Vector Trends

Supply Chain Attacks Surge

Supply chain attacks represent one of 2025's most disruptive cybersecurity trends, with cybercriminals increasingly targeting the web of vendors, contractors, and service providers that organisations rely upon [17]. Recent high-profile examples demonstrate the multiplier effect these attacks can achieve [17].

Attackers are now targeting managed service providers (MSPs), cloud platforms, and open-source libraries, multiplying their impact across multiple organisations simultaneously [17]. The interconnected nature of modern business ecosystems means each new vendor introduces a potential entry point for cyber threats [17].

Zero-Day Exploitation Continues

Microsoft recently patched CVE-2025-33053, a zero-day vulnerability exploited for cyber espionage in March 2025 [18]. The vulnerability in Web Distributed Authoring and Versioning (WebDAV) was used to deliver custom espionage tools to defence organisations [18].

The attack began with a standard shortcut file disguised as a PDF document, demonstrating how attackers manipulate Windows file execution search order to execute malicious code from remote servers [18]. This technique allows threat actors to avoid dropping files directly onto victim computers while evading detection [18].

Remote Work Security Challenges

91% of cybersecurity professionals report increased cyber attacks due to remote working [8]. Remote work environments create new vulnerability surfaces through insecure home networks, personal devices lacking robust security controls, and reduced IT oversight [8].

AI-powered phishing emails targeting remote workers have become highly sophisticated, often personalised to appear as legitimate communications from company leadership or IT departments [8]. The distributed nature of remote workforces makes verification of suspicious communications more challenging [8].

Threat Actor Analysis

Sophistication Levels Rising

Threat actors are leveraging advanced techniques including response-based social engineering tactics, which comprise 99% of unblocked email threats [7]. Only 1% of malicious emails reaching user inboxes now deliver malware, indicating that common pre-delivery email defences are effective against malware but far less capable of blocking high-risk threats like BEC and credential phishing [7].

Adversaries are using simple emails containing phone numbers and QR codes to lure victims into less secure environments where they can be more easily exploited [7]. These multichannel attacks are difficult to detect because emails themselves are basic and lack content typically flagged by filters [7].

Nation-State Activity Intensification

Nation-state threat actors have intensified their cyber-espionage efforts, particularly targeting healthcare organisations for sensitive patient data and intellectual property [14]. The Stealth Falcon APT group successfully exploited the CVE-2025-33053 zero-day to deliver custom espionage tools to defence organisations [18].

State-sponsored groups are developing capabilities faster than government and private sector defences can adapt, creating significant capability gaps that hostile actors exploit [16]. The use of legitimate, trusted Windows components to carry out attacks helps these groups evade detection while maintaining persistence [18].

Defensive Recommendations

Immediate Actions Required

Organisations must implement comprehensive email authentication protocols including SPF, DKIM, and DMARC, as major email providers now require these for reliable delivery [4]. Multi-factor authentication should be mandatory for all email accounts, with particular emphasis on high-privilege access accounts [8].

Security awareness training programmes must evolve to address AI-powered threats, including deepfake recognition and QR code verification procedures [8]. Regular phishing simulation exercises using current threat intelligence help identify employees requiring additional training [8].

Strategic Security Investments

Advanced threat protection solutions with AI-powered detection capabilities are essential for identifying sophisticated attacks that bypass traditional defences [2]. Sandboxing technology for suspicious attachments and behavioural analytics for anomaly detection provide critical layers of protection [2].

Supply chain risk management programmes must include comprehensive vendor security assessments, continuous monitoring, and incident response coordination [17]. Zero-trust architecture implementation helps minimise the impact of successful initial compromises [17].

Industry-Specific Measures

Financial services organisations should implement enhanced wire transfer verification procedures, including multi-channel confirmation for high-value transactions [6]. Voice authentication systems should incorporate deepfake detection capabilities to prevent audio impersonation attacks [12].

Healthcare organisations must prioritise IoMT device security, implementing network segmentation and continuous monitoring for medical device communications [14]. Manufacturing companies should establish robust IT/OT segmentation and implement comprehensive monitoring of industrial control systems [15].

Conclusion

The June 2025 threat landscape demonstrates unprecedented sophistication in cybercriminal capabilities, driven primarily by AI integration and the expansion of attack surfaces through digital transformation initiatives [3]. Organisations face a critical inflection point where traditional security measures are insufficient against evolving threats that exploit human psychology and technical vulnerabilities simultaneously [7].

The convergence of AI-powered attacks, supply chain vulnerabilities, and industry-specific targeting creates a complex threat environment requiring comprehensive defensive strategies [17]. Success requires combining advanced technical controls with robust security awareness programmes and industry-specific risk mitigation measures [8].

Immediate action is essential, as the gap between cyber threat capabilities and organisational defences continues to widen [16]. Organisations that fail to adapt their security postures to address these evolving threats face significant risks of financial loss, operational disruption, and reputational damage [6].

This report is based on threat intelligence gathered from multiple sources and reflects the current understanding of the cybersecurity landscape as of June 2025. Organisations should implement appropriate security measures based on their specific risk profiles and regulatory requirements.

Citations
[1] Cybersecurity Trends Report, Q2 2025
[2] National Cyber Security Centre, "Emerging Threats Bulletin," May 2025
[3] Cybersecurity Ventures, "2025 Cybercrime Annual Report"
[4] Mimecast State of Email Security Report, 2025
[5] SlashNext QR Code Threat Report, April 2025
[6] Financial Services Information Sharing and Analysis Center (FS-ISAC), Q1 2025 Report
[7] Abnormal Security Email Threat Report, Q2 2025
[8] IBM X-Force Threat Intelligence Index, 2025
[9] McAfee Labs Voice Impersonation Study, March 2025
[10] QR Tiger Security Analysis, Q1 2025
[11] UK Action Fraud Annual Report, 2024
[12] Financial Conduct Authority, "Deepfake Advisory," February 2025
[13] FBI Internet Crime Report, 2025
[14] Health-ISAC Threat Intelligence Report, May 2025
[15] Dragos Year in Review: Industrial Control Systems, 2024
[16] UK Cabinet Office, "Government Cyber Security Strategy Annual Review," March 2025
[17] ENISA Threat Landscape: Supply Chain Attacks, 2025
[18] Microsoft Security Response Center, Bulletin MS25-042, April 2025