Security Report · github.com/jacobdjwilson

Nozomi H2 2025 Report Highlights Credential Exposure and OT/IoT Security Gaps

Oct 21, 2026 · Original Report (PDF) ↗

Summary

Nozomi Networks’ H2 2025 report links 26.5% of observed alerts to adversary-in-the-middle techniques. It also finds widespread wireless protection gaps and high or critical severity in 48% of observed 2025 vulnerabilities.

Key points

Findings draw on anonymized customer production telemetry, with validation, filtering and deduplication; separate globally distributed honeypots supply the IoT botnet observations.
Adversary-in-the-middle alerts rose from 16% in H1 2025 to 26.5% in H2. In the UK, these alerts were associated with widespread cleartext passwords in unencrypted traffic.
Transportation, manufacturing and government recorded the highest alerts per organization among eligible sectors; the UK, Germany and Australia led the country rankings.
Of vulnerabilities discovered in 2025 and observed in monitored environments, 48% were high or critical severity. Use-after-free was the most prevalent weakness category at 13.8%.
Management Frame Protection was absent from 68% of observed wireless networks, down from 83% previously. The supplied report gives inconsistent figures for enterprise authentication adoption.
Honeypot activity peaked at 1,169 source IP addresses on September 2, 2025, which researchers linked to a Mirai-clone upgrade; default credential attempts remained common.
The report recommends continuous OT/IoT asset and wireless visibility, replacing default credentials, and prioritizing remediation using exploitability, asset criticality and operational impact.

Article Details

Publisher: Nozomi Networks Labs
Report Period: 2025-07-01 to 2025-12-31
Scope: Global OT/IoT customer telemetry, industrial wireless exposure, vulnerability research disclosures, and separately collected IoT botnet honeypot observations.
Key Statistics: Adversary-in-the-Middle was associated with 26.5% of customer alerts in H2 2025, compared with 16.0% in H1 2025.
Of vulnerabilities discovered in 2025 and detected in monitored environments at the end of the reporting period, 48% had High or Critical CVSS severity.
Approximately 68% of observed wireless networks lacked Management Frame Protection, compared with 83% in the preceding reporting period.
Scattered Spider accounted for 42.9% of actor-linked alerts in H2 2025; attribution was based on detections of malware the report associates exclusively with particular actors.
Honeypots recorded attacks from 1,169 distinct source IP addresses on 2025-09-02, the reporting period's largest daily spike, which the report linked to an upgrade of a Mirai clone.
Recommendations: Maintain continuous visibility into OT and IoT assets, communications, dependencies, and normal operational behavior.
Prioritize vulnerability remediation using asset criticality, exploitability, network exposure, and operational impact rather than CVSS alone.
Deploy malware detection and blocking that inspect industrial protocols, monitor lateral movement, and identify previously unseen malicious payloads.
Deploy dedicated wireless threat detection to identify rogue access points, unauthorized devices, misconfigurations, missing Management Frame Protection, and wireless attack paths.
Change default device credentials and configure security monitoring to alert when those credentials appear in network traffic.