Extortion and ransomware drive over half of cyberattacks

Extortion and ransomware now drive more than half of cyberattacks, with the latest Microsoft Digital Defense Report noting that over 52% of incidents with known motives were driven by extortion or ransomware. In 80% of the cyber incidents investigated by Microsoft’s security teams last year, attackers sought to steal data, a trend driven more by financial gain than intelligence gathering.

The report also highlights that attacks focused solely on espionage accounted for just 4%, while nation-state threats remain a serious and persistent risk alongside opportunistic criminals. Identity-based attacks surged by 32% in the first half of 2025, and more than 97% of identity attacks are password attacks, with criminals increasingly using infostealer malware to harvest credentials.

Phishing-resistant MFA is cited as capable of stopping over 99% of such attacks, and Microsoft’s DCU disrupted Lumma Stealer in May 2025 in collaboration with the US Department of Justice and Europol. According to the report, attacks are becoming more expansive and unpredictable as nation-state actors leverage the cybercriminal ecosystem, underscoring the need for broad collaboration and strong defensive measures.