76% of successful cyber attacks use malware

A Positive Technologies study found that malware remains the primary tool of cybercriminals. In Q2 2025, it was used in 76% of successful attacks, leading to data leaks (52%) and disruption of business operations (45%).

Sep 15, 2025 0 2

76% of successful cyber attacks use malware

According to Positive Technologies' H1 2025 research, malware remains a key tool for cybercriminals. Its use in successful attacks on organizations reached 76% in the second quarter. The main consequences of such attacks were leaks of confidential data and disruption of companies' business processes.

There has been a significant increase in malware usage, up 26% compared to Q1 2025. The most common types remain ransomware, remote control malware, and spyware.

Attackers are actively developing methods to bypass protection, creating more stealthy variations of malware. The share of downloaders used for multi-stage and stealthy deployment of the main malicious code, such as Trojans, infostealers and encryptors, has increased threefold.

At the same time, the use of legitimate software in cyberattacks is growing, allowing attackers to mask their actions. Experts predict an increase in the number of complex attacks that combine several types of malware, as well as an increase in targeted and covert operations aimed primarily at stealing data, rather than encrypting it.

"Malware continues to evolve, becoming more complex and dangerous. Attackers actively use multi-stage delivery schemes, legitimate software, and obfuscation methods to bypass traditional protection tools. In such conditions, it is critical to implement a multi-level security system, including modern sandboxes, such as PT Sandbox, which, using ML technologies, can analyze suspicious objects and prevent malware from entering the organization's circuit."
Kirill Shipulin, Head of PT NAD Expertise at Positive Technologies

To protect against modern threats, organizations are advised to use comprehensive solutions that include antiviruses, next-generation firewalls, sandboxes, and security monitoring systems.