IBM X-Force Report Finds Public-Facing Application Exploitation Rose 44% in 2025
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
IBM X-Force's 2026 report finds exploitation of public-facing applications led initial access in 2025, accounting for 40% of cases. It also documents fragmented ransomware operations and growing supply-chain and credential risks.
Key points
- Drawing on incident response, penetration tests and threat intelligence, X-Force found public-facing application exploitation increased 44% in 2025; valid credentials accounted for 32% of initial access cases.
- Of nearly 40,000 vulnerabilities tracked in 2025, 56% required no authentication to exploit.
- IBM reported a nearly fourfold increase in major supply-chain or third-party compromises over five years, highlighting abuse of developer workflows, credentials and trusted integrations.
- X-Force identified 109 active ransomware or extortion groups, up from 73 in 2024; victim claims on ransomware leak sites increased approximately 12%.
- More than 300,000 ChatGPT credentials were observed for sale. IBM linked the exposure to infostealers and older leaked collections, reporting that the posted credentials were no longer valid.
- Manufacturing accounted for 27.7% of investigated incidents, narrowly ahead of finance and insurance at 27%; North America represented the largest regional share at 29%.
- Recurring weaknesses included misconfigured access controls, weak authentication, incomplete logging and inadequate vulnerability management; IBM recommends stronger identity controls, patching and continuous monitoring.
Article Details
- Publisher
- IBM X-Force
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global threat activity assessed through incident response, penetration testing, dark-web monitoring and other threat intelligence sources.
- Key Statistics
- Exploitation of public-facing applications accounted for 40% of initial-access cases in 2025, a 44% increase over 2024; valid credentials accounted for 32%.
- Of nearly 40,000 vulnerabilities tracked by X-Force in 2025, 56% required no authentication to exploit.
- Over 300,000 ChatGPT credentials were observed for sale in 2025. The report states that posted credentials were no longer valid and corresponded to infostealer infections and leaked collections from 2024 and earlier.
- X-Force identified 109 active ransomware or extortion groups in 2025, compared with 73 in 2024. Ransomware leak-site victim counts increased approximately 12%; these entries represent attacker claims, not confirmed incidents.
- Manufacturing accounted for 27.7% of investigated incidents in 2025, remaining the most-targeted industry for the fifth consecutive year; finance and insurance accounted for 27%.
- Recommendations
- Centralize identity access management and governance across human and machine identities; apply strong authentication, passkeys and continuous risk-based access controls.
- Enforce authentication and authorization in public-facing and internal applications, APIs and service-to-service communications.
- Continuously identify and remediate missing patches, insecure code, misconfigurations and weak credentials; conduct regular penetration testing across the technology stack.
- Assess enterprise AI adoption, protect AI service credentials and tokens, and monitor abnormal access patterns and credential exposure.
- Identify and actively manage supply-chain and third-party dependencies, and protect sensitive data through encryption, access controls, data loss prevention, monitoring and auditing.
MITRE ATT&CK
T1078 · Valid AccountsAttackers used stolen legitimate credentials to access mailboxes, enterprise environments and cloud services.T1110.001 · Password GuessingPassword brute forcing was among the frequent attack patterns identified in X-Force Red penetration testing.T1133 · External Remote ServicesExternal remote services were observed as initial-access vectors across multiple industries.T1136.003 · Cloud AccountThe report describes attackers using stolen developer or CI/CD credentials to create unauthorized administrator accounts in cloud environments.T1190 · Exploit Public-Facing ApplicationExploitation of public-facing applications was the leading initial-access vector observed in 2025.T1195.002 · Compromise Software Supply ChainAttackers compromised software packages and distribution workflows, embedding payloads in post-install scripts or build hooks to reach downstream users.T1199 · Trusted RelationshipThe report identifies trusted relationships as an initial-access vector and describes intrusions through vendors and managed service relationships.T1486 · Data Encrypted for ImpactRansomware groups combined file encryption with data exfiltration and threats to leak stolen information.T1496 · Resource HijackingDigital currency mining was an observed impact in 1% of incident response engagements.T1505.003 · Web ShellWebshell deployment accounted for 18% of malware cases in X-Force incident response data.T1528 · Steal Application Access TokenAttackers stole Drift OAuth tokens and used them to access multiple Salesforce environments.T1555 · Credentials from Password StoresX-Force Red research demonstrated extraction and decryption of service-account passwords stored in an SCCM database after compromise of a site server.T1566.001 · Spearphishing AttachmentSpearphishing attachments were observed as an initial-access vector in government and Middle East and Africa incidents.T1566.003 · Spearphishing via ServiceSpearphishing via service accounted for half of the initial-access vectors observed in wholesale incidents.
Threat Actors
Hive0145Its 2025 operation against German organizations delivered Strela Stealer to harvest Microsoft Outlook and Mozilla Thunderbird credentials.LAPSUS$Reportedly targets telecoms, outsourcing firms and identity providers through MFA reset abuse and insider recruitment. The report states it formed an alliance with Scattered Spider and ShinyHunters in mid-2025.Scattered SpiderDescribed as a social-engineering intrusion group exploiting help desks, identity providers and cloud access pathways. The report states it formed an alliance with LAPSUS$ and ShinyHunters in mid-2025.ShinyHuntersDescribed as a data-theft collective breaching SaaS platforms and consumer services. The report states it formed an alliance with Scattered Spider and LAPSUS$ in mid-2025.Silver FoxDescribed by the report as a China-based nation-state group conducting intelligence and financially motivated operations; explicitly identified as also known as Void Arachne and The Great Thief of Valley.
Malware
Acreedwidespread, while newer families like Acreed expanded their presence in underground markets.ClopThe X-Force team’s review of dark-web activity indicated that Qilin, Clop, KillSecurity, IncRansom and Play wereIncRansomThe X-Force team’s review of dark-web activity indicated that Qilin, Clop, KillSecurity, IncRansom and Play wereKillSecurityThe X-Force team’s review of dark-web activity indicated that Qilin, Clop, KillSecurity, IncRansom and Play wereLummaWhile 2025 saw considerable takedowns of infostealer malware infrastructure—such as with Lumma andPlayThe X-Force team’s review of dark-web activity indicated that Qilin, Clop, KillSecurity, IncRansom and Play wereQilinThe X-Force team’s review of dark-web activity indicated that Qilin, Clop, KillSecurity, IncRansom and Play wereRhadamanthysRhadamanthys—the use of infostealer malware remains an easy method for threat actors to gain access.StealCfamilies in 2025. Well-known stealers such as Lumma, RisePro, Vidar, Stealc and Rhadamanthys remainedStrela StealerHive0145’s 2025 operation against German organizations delivered Strela Stealer specifically to harvest
Vendors
Anthropic(Anthropic)—were reviewed for accounts for sale on the dark web containing credentials for the platforms.GoogleThe top 5 platforms—ChatGPT (OpenAI), Microsoft Copilot, Google Gemini, Perplexity and Claude AIIBMThe biggest trends the IBM X-Force team observed in 2025 were a surge in broad‑based exploitations ofMicrosoftMicrosoft Outlook and Mozilla Thunderbird logins. Once obtained, those real credentials allowed attackers toOpenAIThe top 5 platforms—ChatGPT (OpenAI), Microsoft Copilot, Google Gemini, Perplexity and Claude AI
Products
ChatGPT>300K ChatGPT credentials observed for sale on the dark webClaude AIThe top 5 platforms—ChatGPT (OpenAI), Microsoft Copilot, Google Gemini, Perplexity and Claude AIGitHub ActionsCI/CD platforms like GitHub Actions and GitLab CI have become prime targets for credential theft and workflowGitLab CICI/CD platforms like GitHub Actions and GitLab CI have become prime targets for credential theft and workflowGoogle GeminiThe top 5 platforms—ChatGPT (OpenAI), Microsoft Copilot, Google Gemini, Perplexity and Claude AIMicrosoft CopilotThe top 5 platforms—ChatGPT (OpenAI), Microsoft Copilot, Google Gemini, Perplexity and Claude AIPerplexityThe top 5 platforms—ChatGPT (OpenAI), Microsoft Copilot, Google Gemini, Perplexity and Claude AISalesforceDrift OAuth tokens and used them to break into multiple Salesforce environments—shows chatbot‑token-basedSalesloft Driftcredentials that enable access to other systems—illustrated by the Salesloft/Drift incident, where attackers stoleSCCMcredentials. Our X-Force Red Adversary Services team published research around SCCM (Microsoft’s System
Countries
ChinaSilver Fox (also known as Void Arachne or The Great Thief of Valley), a China-based nation-state group,FranceSimilarly, the France-focused spear-phishing wave used leaked ISP customer data to lure victims into enteringGermanyAnyDesk is a trademark or registered trademark of AnyDesk Software GmbH in Germany and other countries.North KoreaNorth Korea nation-state actors are using information stealers, once thought to be used largely by
Industries
Energyreflecting the region’s growing financial landscape and associated risks. Additionally, the energy industryFinance and insurancea few tenths of a percent higher than the finance and insurance sectors, which accounted for 27%GovernmentScattered Spider is confirmed in multiple industry and government reports as a social-engineering-drivenHealthcareHealthcare: 4%ManufacturingManufacturing was the top-targeted industry for the fifth year in a rowProfessional, business and consumer servicesProfessional, business and consumer services: 9%Retailretail (13%).Transportationfinance and insurance (17%) and transportation (7%).Wholesaleinvestigated, while wholesale (19%) and the finance and insurance sector (17%) followed behind, also