CSIS Security Group is a member of the Allurity family.
CSIS LOGO
CSIS Portal
Under Attack?
Cover banner for the CSIS Threat Matrix Report Autumn 2025 edition.
Cyber threat insights

Threat Matrix Report · Autumn 2025 Edition

Access CSIS's Autumn 2025 update on the cyber threat landscape, drawing on frontline incident response, MDR telemetry, and threat intelligence. Learn how stolen identity fuels intrusion, as information stealers, AI tooling, and social engineering, erode the line between crime and espionage.

What's inside this edition

  • Real World Scenarios: How CSIS responders contained a Qilin ransomware breach that destroyed both live and backup systems, and traced a manufacturer's compromise back to a remote-access tool left running years after the vendor departed. 
  •  The shift to user-assisted compromise: Why "ClickFix" and fake-CAPTCHA lures — up 517% in H1 2025 — now trick users into running their own compromise, and how the technique crossed from commodity crimeware into state-linked APT toolchains.
  •  Supply-chain and malware trends:  ERansomHub's April collapse and the scramble to Qilin and DragonForce, relentless information-stealer rebranding, poisoned npm and PyPI packages, and mobile threats from NFC-relay fraud to firmware-level implants.
  •  Hacktivism and geopolitics: Pro-Russian DDoSia attacks on UK, Danish and Norwegian public services despite July's Operation Eastwood takedown, plus SecAlliance analysis of cyber as statecraft across the Americas, Europe, and the Indo-Pacific.
  •  Phishing-as-a-service goes turnkey: Inside phishing veteran Chenlun's ‘outsider kit’ — generative-AI template workflows, one-click deployment, and Google Drive exfiltration that let low-skill actors run multilingual campaigns at scale. 
  •  Key statistics: Curated numbers on ransomware payments, C2 infrastructure, phishing brand abuse, and the billions of credentials resurfacing in so-called combo-leaks.
CSIS_people_stefan tanase_blue

Watch the webinar

In our on-demand webinar, CSIS cyber intelligence expert Stefan Tanase unpacks the Spring 2026 report findings — which threats are accelerating, which defences are working, and where organisations are still exposed.

Watch the Autum 2025 webinar →

Threat Matrix Report Autumn 2025_1x2_small

About the Threat Matrix Reports

 CSIS's Threat Matrix Reports deliver detailed, real-world insights on the cyber threat landscape. Each report draws on proprietary data from our Managed Detection and Response work, Cyber Threat Intelligence feeds, and Emergency Incident Response teams — ensuring that the report’s findings are grounded in frontline experience.

CSIS Security Group A/S is a member of the Allurity family. Learn More.