A new report from Sophos, a global leader in cybersecurity solutions, reveals critical insights into attacker behavior in 2024. The 2025 Sophos Active Adversary Report, based on over 400 Managed Detection and Response (MDR) and Incident Response (IR) investigations, highlights the speed and efficiency with which cybercriminals are now operating.
“Passive security is no longer enough. Organizations must actively monitor networks and respond swiftly. Proactive monitoring, as seen in MDR cases, significantly reduces dwell time and improves outcomes,” said John Shier, field CISO.
Here are the seven key findings:
- Remote Services Are Prime Targets: Attackers primarily gain initial network access (56% of cases) by exploiting external remote services like firewalls and VPNs, often using valid accounts.
- Compromised Credentials Remain Top Root Cause: For the second consecutive year, compromised credentials are the leading cause of attacks (41%), followed by exploited vulnerabilities (21.79%) and brute force attacks (21.07%).
- Rapid Data Exfiltration: The median time from attack initiation to data exfiltration in ransomware, data exfiltration, and data extortion cases is only 72.98 hours (3.04 days), with detection occurring just 2.7 hours after exfiltration.
- Quick Active Directory Breach: Attackers can breach Active Directory (AD) within a median of 11 hours, enabling rapid control of an organization’s systems.
- Top Ransomware Groups: In 2024, Akira was the most prevalent ransomware group in Sophos cases, followed by Fog and LockBit.
- Decreased Dwell Time: Overall dwell time (time from attack start to detection) has dropped to 2 days, down from 4, largely due to MDR’s rapid detection capabilities. MDR cases show a dwell time of only 3 days for ransomware and 1 day for non-ransomware. IR cases remained at 4 days for ransomware and 11.5 days for non-ransomware.
- Overnight Attacks: 83% of ransomware binaries are deployed outside of target organizations’ local business hours, indicating attackers leverage off-hours for maximum impact.
Key Recommendations:
To counter these threats, Sophos recommends:
- Closing exposed Remote Desktop Protocol (RDP) ports (RDP was abused in 84% of cases).
- Implementing phishing-resistant multifactor authentication (MFA).
- Promptly patching vulnerabilities, particularly in internet-facing systems.
- Deploying and actively monitoring EDR or MDR solutions 24/7.
- Developing and regularly testing incident response plans.
Read the full It Takes Two: The 2025 Sophos Active Adversary Report on Sophos.com.