5 Threats That Defined Security in 2025

2025 saw Salt Typhoon, a China-nexus APT, persistently targeting telecoms such as Verizon, AT&T and Lumen Technologies, following its discovery last autumn and continuing to pre-position for long-term espionage. In July, it was reported that Salt Typhoon hacked the US National Guard for nearly a year, highlighting the scale of its campaign against critical infrastructure.

Meanwhile, CISA faced significant upheaval with layoffs and budget cuts as part of government downsizing efforts, after the Trump administration shuttered the CSRB early in the year. React2Shell emerged as a high-severity issue, tied to CVE-2025-55182 with a CVSS of 10, and was seen affecting a large share of cloud providers, with public reporting of over half a million affected domains.

Shai-Hulud, a self-propagating open-source malware, opened floodgates in September by infecting packages and cascading across thousands of projects through the open-source ecosystem. Finally, campaigns targeting Salesforce customers grew prominent, with a breach linked to Salesloft’s GitHub and downstream attacks affecting hundreds of Salesforce instances, underscoring a broader movement toward SaaS-ecosystem exploitation.