Security Report · raw.githubusercontent.com

Rapid7 Report Finds Faster Exploitation and Expanding Ransomware Activity in 2025

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Rapid7’s 2026 threat report finds confirmed exploitation of newly disclosed CVSS 7–10 flaws rose 105% in 2025. Weak MFA remained a leading intrusion factor, while ransomware leak posts increased 46.4%.

Key points

In Rapid7’s dataset of CVSS 7–10 vulnerabilities published in each analyzed year, confirmed exploited flaws increased from 71 in 2024 to 146 in 2025.
For same-year CVSS 7–10 disclosures subsequently added to CISA KEV, median publication-to-inclusion time fell from 8.5 to five days; this measures catalog inclusion, not the exact onset of exploitation.
Valid accounts without MFA accounted for 43.9% of Rapid7’s 2025 incident response cases, followed by vulnerability exploitation at 24.6% and exposed services at 7.0%.
Across underground forums monitored over six months, RDP represented 21.2% of advertised access, followed by VPN at 12.8% and RDWeb at 11.2%, illustrating the market for compromised remote access.
Ransomware appeared in 42% of Rapid7 MDR incident response investigations. Tracked leak posts rose from 6,034 to 8,835, while unique active groups increased from 102 to 140.
The report describes attackers abusing cloud identity, collaboration platforms, and edge infrastructure, with AI accelerating established phishing, reconnaissance, and operational workflows rather than necessarily introducing new capabilities.
Rapid7 recommends exposure-based remediation, stronger MFA and help-desk controls, rapid session and token invalidation, and isolated immutable backups with tested recovery procedures.

Article Details

Publisher: Rapid7
Report Period: 2025-01-01 to 2025-12-31
Scope: Global vulnerability exploitation, incident response, underground access markets, ransomware leak-site activity, and state-aligned cyber operations.
Key Statistics: Among CVSS 7–10 vulnerabilities published in the calendar year analyzed, confirmed exploitation increased from 71 in 2024 to 146 in 2025, approximately 105%.
For same-year CVSS 7–10 disclosures subsequently added to CISA KEV, median publication-to-inclusion time fell from 8.5 days in 2024 to 5.0 days in 2025; the mean fell from 61.0 to 28.5 days.
Valid accounts without MFA accounted for 43.9% of Rapid7's 2025 incident response incidents; vulnerability exploitation accounted for 24.6%, and exposed services for 7.0%.
Ransomware was involved in 42% of Rapid7 MDR incident response investigations in 2025.
Observed ransomware leak posts increased from 6,034 in 2024 to 8,835 in 2025, a 46.4% rise; unique active groups increased from 102 to 140. Leak posts represent extortion claims rather than independently confirmed incidents.
Recommendations: Enforce correctly configured MFA on critical systems, remote access points, and privileged accounts; limit push attempts and enable number matching.
Harden help-desk procedures and restrict high-risk password resets.
Continuously patch network-edge devices, prioritizing known exploitation and organizational exposure.
Maintain immutable backups isolated from production networks and regularly test recovery procedures.
Monitor outbound AI API calls, protect API tokens, and log agent and tool actions.