Kaspersky’s Global Research and Analysis Team (GReAT) has outlined their predictions for the 2025 advanced persistent threat (APT) landscape, highlighting significant shifts in cyber threats.
These include the rise of hacktivist alliances, increased use of AI-powered tools by state-affiliated actors – often with embedded backdoor, more supply chain attacks on open-source projects, and a surge in malware development using Go and C++.
The team monitors more than 900 APT groups and operations worldwide to provide a roadmap for organisations and cybersecurity professionals to prepare for the year ahead.
Broadening the use of AI in the hands of state-affiliated actors
In 2024, cybercriminals and APT groups have increasingly leveraged AI for more convincing attacks. The Lazarus Group, for instance, used AI-generated images to exploit a Chrome zero-day vulnerability and steal cryptocurrency.
Another concerning trend involves APT groups distributing backdoored versions of AI models. They may target popular open-source AI models and datasets, embedding malicious code or introducing subtle biases that are difficult to detect but widely disseminated. GReAT experts suggest LLMs will become standard tools for reconnaissance, automating vulnerability detection, and generating malicious scripts to enhance attack success rates.
“AI is a double-edged sword – while cybercriminals use it to enhance their attacks, defenders can harness its power to detect threats faster, and strengthen security protocols. However, cybersecurity experts must approach this powerful tool with caution, ensuring that its use doesn’t inadvertently open new avenues for exploitation,” comments Maher Yamout, lead security researcher at Kaspersky’s GReAT.
Experts also anticipate that APT groups will increasingly adopt deepfake technology to impersonate key individuals. This could involve creating highly convincing messages or videos to deceive employees, steal sensitive information, or execute other malicious actions.
Other advanced threat predictions for 2025 include:
- Rising Supply Chain Attacks on Open-Source Projects – While the infamous XZ case highlighted a significant issue, this incident has heightened awareness within the cybersecurity community and prompted organisations to enhance monitoring of open-source ecosystems. While the frequency of such attacks may not increase dramatically, the number of ongoing attacks being discovered is likely to rise as detection efforts improve.
- C++ and Go malware to adapt to the open-source ecosystem – As open-source projects increasingly adopt modern versions of C++ and Go, threat actors will need to adapt their malware to align with these widely used languages. In 2025, we can expect a significant rise in APT groups and cybercriminals migrating to the latest versions of C++ and Go, capitalising on their growing prevalence in open-source projects.
- IoT as a Growing APT Attack Vector in 2025 – With IoT devices expected to reach 32-billion by 2030, security risks will increase. Many devices rely on insecure servers and outdated firmware, making them vulnerable. Attackers will exploit weaknesses in apps and supply chains, embedding malware during production. As visibility into IoT security remains limited, defenders will struggle to keep up, and this situation is likely to worsen by 2025.
- Hacktivist Alliances to Escalate in 2025 – Hacktivist groups are increasingly forming alliances, sharing tools and resources to pursue larger, more impactful objectives. By 2025, these alliances will likely grow in scale, leading to more coordinated and disruptive campaigns as groups unite around common socio-political goals.
- BYOVD exploits in APT campaigns – BYOVD (bring your own vulnerable driver) technique has become a trend in 2024. Looking ahead, this trend is expected to continue into 2025. As attackers become more adept at leveraging low-level vulnerabilities, the complexity of such attacks is likely to increase, and we may see even more refined techniques, such as exploiting outdated or third-party drivers that are not typically scrutinised for security flaws.