IBM's 2025 X-Force Threat Intelligence Index: Credential Theft on the Rise

In a striking observation, IBM X-Force reported an 84% increase in emails delivering infostealers in 2024 compared to the previous year. These tactics have emerged as the primary method for attackers seeking to scale identity theft. Nearly one in three incidents recorded in 2024 involved credential theft, showcasing the attackers' investment in multiple pathways to access, exfiltrate, and monetize login information.

Mark Hughes, Global Managing Partner of Cybersecurity Services at IBM, emphasized the subtlety of these attacks, stating, "Cybercriminals are most often breaking in without breaking anything – capitalizing on identity gaps overflowing from complex hybrid cloud environments that offer attackers multiple access points." He urged businesses to adopt proactive measures, including modernizing authentication management and conducting real-time threat hunting.

The report sheds light on the vulnerabilities faced by critical infrastructure organizations, which accounted for 70% of all attacks IBM X-Force responded to last year. More than a quarter of these attacks stemmed from vulnerability exploitation, exacerbated by reliance on legacy technology and slow patching cycles.

IBM X-Force's analysis of common vulnerabilities and exposures (CVEs) revealed that four of the top ten CVEs were linked to sophisticated threat actor groups, including nation-state adversaries. The open trading of exploit codes on dark web forums has created a burgeoning market for attacks targeting essential services like power grids and healthcare.

The trend of automated credential theft has sparked a chain reaction, with IBM X-Force noting a staggering 180% increase in phishing emails delivering infostealers in early 2025 compared to 2023. This increase can be attributed to cybercriminals leveraging artificial intelligence to generate phishing emails at scale.

Credential phishing and infostealers have made identity attacks not only cheaper but also highly profitable. The top five infostealers alone had over eight million advertisements on the dark web, showcasing the vast market for stolen credentials. Furthermore, the availability of adversary-in-the-middle phishing kits highlights the need for robust multi-factor authentication measures.

While ransomware incidents comprised the largest share of malware cases in 2024, accounting for 28%, IBM X-Force observed a reduction in overall ransomware incidents compared to the previous year. This decline reflects the impact of international law enforcement efforts, forcing ransomware operators to restructure their high-risk models.

Notably, well-known malware families have either shut down operations or transitioned to less risky malware types, demonstrating the adaptability of cybercrime groups as they seek new avenues for profit.

The report identifies Asia and North America as the most attacked regions, collectively accounting for nearly 60% of all incidents IBM X-Force responded to globally. Within the industrial sector, manufacturing has consistently been the most targeted industry, particularly vulnerable to ransomware attacks due to its low tolerance for downtime.

Additionally, IBM X-Force's collaboration with Red Hat Insights revealed that more than half of Red Hat Enterprise Linux customers had not deployed critical patches in their environments, exposing them to potential threats from active ransomware families.

As cyber threats continue to evolve, the 2025 X-Force Threat Intelligence Index serves as a crucial reminder for organizations to prioritize cybersecurity. The findings underscore the necessity for businesses to modernize their security measures, invest in advanced threat detection technologies, and engage in continuous monitoring of dark web activities.

IBM's commitment to providing robust cybersecurity solutions is evident as the company continues to support clients in navigating the complexities of the digital landscape. As organizations prepare for the challenges ahead, the insights from the X-Force Threat Intelligence Index will be invaluable in shaping their security strategies.

For those interested in a deeper dive into the findings, IBM is hosting a webinar on April 22, 2025, at 11:00 am ET, where experts will discuss the report's key takeaways and implications for businesses worldwide.