HPE has released results from its inaugural cyberthreat research report, In the Wild, showing a striking shift in how cyber adversaries operate at scale across global industries and critical public sectors.
The report shows that cybercrime has ‘gone industrial’, with attackers using automation and long-standing vulnerabilities to scale campaigns and repeatedly compromise high-value targets faster than defenders can respond.
The report shows a global cyber threat environment defined by scale, organization, and speed. Based on the analysis of 1,186 active threat campaigns observed around the world during 2025, the findings reveal a rapidly evolving adversary ecosystem defined by professionalism, automation, and strategic targeting, with attackers using repeatable infrastructure and long-standing vulnerabilities to target high-value sectors with precision.
Industrial-scale infrastructure fuels modern threat campaigns
HPE Threat Labs observed an increase in both the volume of attacks and the sophistication of adversary tactics and techniques. Threat actors, including nation-state-linked espionage groups and organized cybercrime operations, increasingly ran their operations like large enterprises, using hierarchical command structures, specialized teams, rapid coordination to deploy expansive and industrialized attack infrastructures, and a deep understanding of commonly used workforce applications and documents.
Over the course of the year, threat actors deployed more than 147,000 malicious domains, nearly 58,000 malware files, and actively exploited 549 vulnerabilities. This professionalization of cybercrime makes attacks more predictable in execution, yet harder to disrupt, as dismantling one component of an operation rarely stops the broader campaign.
Automation and AI tools accelerate attacker speed and impact
Attackers also adopted new techniques to increase speed and impact. Some operations used automated ‘assembly line’ workflows over platforms like Telegram to exfiltrate stolen data in real time. Others leveraged generative AI to produce synthetic voices and deepfake videos for targeted video-phishing (vishing) and executive impersonation fraud.
These tactics allowed threat actors to move faster, reach more targets, and concentrate efforts on sectors tied to national infrastructure, critical data, and economic stability. By streamlining operations and prioritizing high-value targets, threat actors were able to pursue financial gain with greater efficiency by strategically ‘following the money’.
