BlueVoyant’s Threat Fusion Cell analyzed vetted OSINT and BVSOC telemetry for the fourth quarter of 2025, tracking more than 300 active threat groups and 600 malware strains, from 96 campaigns. Social engineering, especially phishing, remained the top initial access vector, while vulnerability exploitation matched phishing at 17.5%. Supply chain compromises continued their upward trend, and ransomware operations targeted finance and manufacturing most aggressively. 

This report also highlights key trends and insights across initial access, victimology, sector targeting, malware, and ransomware/extortion. 

Download now to learn: 

• The top initial access methods and their prevalence
• Where attackers are focusing by industry and geography
• Telemetry and malware shifts gleaned from 4Q2025 events