Malware - Insights from 2025 Malicious Infrastructure Report

What Happened

In 2025, Insikt Group expanded its tracking of malicious infrastructure, revealing key insights into various malware families and threat categories. The report highlights the ongoing dominance of Cobalt Strike, while also noting its declining share of command-and-control (C2) servers as new tools gain traction. Notably, Vidar and other infostealers emerged as significant players, filling gaps left by disrupted operations of previous malware families.

The report also emphasizes the rise of tools like RedGuard, Ligolo, and Supershell, which have gained popularity among cybercriminals. This shift indicates a dynamic landscape where threat actors continuously adapt to law enforcement actions and evolving detection capabilities.

Who's Being Targeted

The primary infection vector in 2025 remained infostealers, particularly through malware-as-a-service (MaaS) offerings. Organizations across various sectors are at risk, especially those that rely heavily on digital infrastructure. The volatility in the infostealer ecosystem, with Vidar outperforming competitors, underscores the urgent need for enhanced security measures.

Additionally, the report notes that Android malware continued to dominate the mobile threat landscape, with nine of the top ten malware families targeting mobile devices. This trend emphasizes the importance of securing mobile platforms against emerging threats.

Signs of Infection

Organizations should be aware of several indicators of compromise associated with the evolving malware landscape. Key signs include unusual network traffic patterns, unexpected spikes in access to command-and-control servers, and the presence of known malware families like AsyncRAT and QuasarRAT.

To effectively combat these threats, it is crucial to implement robust network monitoring capabilities and deploy detection mechanisms such as YARA, Sigma, and Snort rules. Continuous monitoring and threat simulations can help organizations validate their defensive posture against these prevalent malware families.

How to Protect Yourself

To safeguard against the evolving threats identified in the report, organizations should prioritize the following actions:

• Enhance detection capabilities to identify and mitigate prevalent malware families.
• Invest in threat simulations to assess the effectiveness of current security measures.
• Monitor the broader threat landscape for emerging trends and tactics used by threat actors.

As malicious infrastructure continues to evolve, organizations must remain vigilant and adaptable. By leveraging insights from the 2025 report, defenders can strengthen their security controls and better prepare for the challenges that lie ahead in 2026.