By Alice Chambers |
Over half (52 per cent) of cyberattacks with known motives were driven by extortion or ransomware, according to the sixth annual Microsoft Digital Defense Report, which covers cybersecurity trends from July 2024 to June 2025.
“Nation-state threats remain a serious and persistent threat, but most of the immediate attacks organisations face today come from opportunistic criminals looking to make a profit,” said Amy Hogan-Burney, corporate vice president of customer security and trust at Microsoft.
Hospitals and local governments are key targets because they store sensitive data or have tight cybersecurity budgets with limited incident response capabilities, often resulting in outdated software. Ransomware attacks in particular focus on these sectors and criminals then sell information on the dark web.
In 2025, both attackers and defenders have increased their use of generative AI. Threat actors are using AI to boost their attacks by automating phishing and scaling social engineering, and defenders are using AI to spot threats, close detection gaps and protect vulnerable users.
More than 97 per cent of identity attacks are password attacks, and in the first half of 2025, identity-based attacks surged by 32 per cent. “Luckily, the solution to identity compromise is simple,” said Hogan-Burney. “The implementation of phishing-resistant multi-factor authentication can stop over 99 per cent of this type of attack even if the attacker has the correct username and password combination.”
Microsoft found that attacks focused solely on espionage made up just four per cent of cyberattacks between July 2024 and June 2025. Nation-state actors including China, Iran, Russia and North Korea, which are focusing on IT, research and academia, and government sectors.
Read more: Hogan-Burney on ‘Extortion and ransomware drive over half of cyberattacks’