Global Cyber Attacks Surge

Global Cyber Attacks Surge

Cybercrime is accelerating at a pace no defender can afford to ignore. New analysis shows that global cyberattacks are becoming more frequent, more automated, more financially motivated — and more geographically concentrated than ever. Between 2024 and 2025, the United States alone accounted for 44% of all documented cyberattacks, highlighting a growing imbalance in global threat distribution and attacker focus.

This surge comes as global cybercrime losses climb toward a projected $15.63 trillion by 2029, up from $10.5 trillion today, fueled by adversaries who are now weaponizing AI, exploiting cloud misconfigurations, and executing deterministic phishing and ransomware campaigns at industrial scale.

This technical blog breaks down why attackers are overwhelmingly targeting the U.S., why public administration has become the most attacked sector, and what the global cybersecurity community must learn from the evolving threat dynamics.

The U.S. Holds 44% of All Recorded Attacks — Why?

Data from the Cyber Events Database (2024–2025) reveals:

  • 646 incidents originated against U.S. organizations
  • The UK followed at 72 incidents
  • Russia: 70 incidents
  • Canada: 40 incidents
  • France: 38 incidents

At surface level, this appears like a disproportionate clustering of attacks.
But technically, it reflects several deeper realities:

1. The U.S. has the world’s largest digital footprint

Every sector — finance, healthcare, SaaS, cloud, defense, and public infrastructure — depends heavily on interconnected digital ecosystems. This results in:

  • The highest density of internet-facing assets
  • The most extensive vendor ecosystems
  • Massive attack surfaces driven by legacy & cloud sprawl

2. High-value data is everywhere

U.S. organizations store global financial data, healthcare records, defense information, and large-scale identity datasets — making them prime monetization targets.

3. Advanced persistent threat (APT) activity is concentrated on U.S. interests

State-backed campaigns routinely target U.S. institutions for:

  • Espionage
  • IP theft
  • Critical infrastructure reconnaissance
  • Supply-chain entry points

4. Reporting standards are stricter

The U.S. discloses more breaches because:

  • SEC requires breach reporting
  • CISA mandates incident reporting
  • State-level laws (California, Maine, NYDFS) enforce transparency

This makes the U.S. appear as the primary target — and in many ways, it is — but it also reflects better visibility compared to underreported regions in Africa, APAC, and LATAM.

Financial Gain: The Core Motive in 69% of Global Attacks

Of 1,468 documented incidents over the past year:

  • 1,013 attacks were financially motivated
  • 145 incidents driven by activism or protest
  • 111 attacks tied to espionage or geopolitical intelligence

Financially motivated breaches increasingly rely on:

1. Phishing & Business Email Compromise (BEC)

Now augmented by deepfake voice clones, AI-written emails, and real-time SaaS MFA interception.

2. Ransomware-as-a-Service (RaaS)

Modern ransomware ecosystems operate like commercial software:

  • Affiliate dashboards
  • Negotiation portals
  • Pre-built payload kits
  • Automated privilege escalation scripts

RaaS enables low-skilled actors to execute high-impact attacks in hours, not months.

3. Cloud token theft & session hijacking

Attackers now prefer non-malware intrusion paths:

  • OAuth token harvesting
  • Compromised API keys
  • Misconfigured S3 buckets
  • Exfiltration through public cloud workloads

As cloud-native adoption grows, token-based compromise has become more profitable than traditional credential theft.

Who Are Attackers Targeting? Public Administration Takes the Hit

Public administration recorded:

  • 308 attacks, the highest across all sectors
  • Healthcare & social assistance: 200 incidents
  • Finance & insurance: 178 incidents

Why public institutions?

1. They rely on aging infrastructure

Government systems often run:

  • Outdated OS builds
  • Unsupported hardware
  • Legacy web stacks
  • Slow-to-patch critical systems

These environments are ideal for exploit chains and lateral movement.

2. They manage critical services

Attackers know downtime creates immediate leverage:

  • Disrupt emergency response
  • Freeze financial operations
  • Interrupt healthcare systems

Ransom demands escalate quickly when public services are impacted.

3. They store high-value citizen data

Including:

  • Identity numbers
  • Employment records
  • Healthcare histories
  • Law enforcement files

This data powers identity fraud markets worldwide.

The Role of Human Error: 95% of Breaches Trace Back to People

The threat landscape isn’t only evolving technologically — the human attack surface remains the weakest link.
Recent global assessments show:

  • 95% of breaches involved human mistakes
  • Misconfigurations are now the #1 cause of cloud data exposure
  • Zero-security-training employees are 4× more likely to fall for phishing
  • Shadow AI tools used by employees pose new risks for data leakage

Even the strongest technical stack fails if employees:

  • Reuse passwords
  • Approve MFA prompts blindly
  • Upload sensitive data into GenAI tools
  • Misconfigure IAM policies in cloud consoles

The Skills Gap: A Global Security Crisis

The world faces a shortage of 4+ million cybersecurity professionals, pushing defenders into reactive postures.
Consequences include:

  • Extended dwell time of attackers
  • Slow incident response
  • Overreliance on automation without oversight
  • Limited monitoring of cloud & SaaS attack surfaces

Attackers operate 24/7. Many enterprise security teams do not.

Generative AI Has Permanently Shifted the Threat Curve

GenAI has transformed attacker workflows by:

1. Making phishing indistinguishable from legitimate communication

Professional-grade grammar, tone mimicry, and conversational accuracy.

2. Enabling synthetic deepfake fraud

Attackers now produce:

  • Deepfake CFO voice calls
  • Video-based ID spoofing
  • Real-time cloned audio for wire fraud

3. Accelerating exploit development

LLMs assist attackers with:

  • Reverse engineering
  • API fuzzing
  • Payload optimization
  • Script automation

This is why ransomware increased by 46% in 2025, according to WEF.

The UK Case Study: A Microcosm of the Global Trend

The UK’s statistics illustrate accelerating risk:

  • 204 nationally significant cyber incidents handled by NCSC
  • 429 total incidents across sectors
  • 43% of businesses reported a breach in the last year
  • 1 in 7 adults became a victim of cybercrime

This aligns with the global trend: attackers are scaling faster than defenders can adapt.

Implications: The Security Strategy That Organizations Must Adopt

A modern defense strategy must include:

1. Zero Trust Architecture

Never trust; always verify:

  • Continuous authentication
  • Micro-segmentation
  • Identity-based access control

2. Supply Chain Security

Attackers increasingly prefer vendors over direct targets.

3. AI-Augmented Threat Detection

Static SIEM rules and signature-based tools are now obsolete.

4. Security Awareness Training

Human-layer defense is mandatory, not optional.

5. Cloud & API Security Controls

Identity-first enforcement, token rotation, and strict IAM governance.

6. Resilience Engineering

Assume breach — build systems that withstand compromise.

Conclusion

The world is entering an era where:

  • Cybercrime could become the world’s third-largest economy by 2026
  • The U.S. absorbs nearly half of global cyberattacks
  • Public institutions remain the softest, highest-value targets
  • AI is accelerating the sophistication and speed of attacks
  • Human error continues to eclipse technical failures

In this environment, resilience will depend not solely on defensive tooling, but on governance, continuous training, and adaptive security architectures that evolve as quickly as attackers do.

Centralise your Appsec

A single dashboard for visibility, collaboration, and control across your AppSec lifecycle.

Explore Live Demo

Read more