2025 CrowdStrike Global Threat Report: China’s Cyber Espionage Surges 150% with Increasingly Aggressive Tactics, Weaponization of AI-powered Deception Rises

Rhea-AI Summary

CrowdStrike (NASDAQ: CRWD) has released its 2025 Global Threat Report, revealing alarming trends in cybersecurity threats. The report highlights a 150% increase in China's cyber espionage operations, with targeted attacks in key sectors rising up to 300%.

Key findings include a 442% surge in voice phishing between H1 and H2 2024, driven by AI-powered social engineering. The report also shows that 79% of initial access attacks are now malware-free, while access broker advertisements increased 50% year-over-year.

Other significant findings include:

• Average eCrime breakout time decreased to 48 minutes
• 26% year-over-year increase in cloud intrusions
• 52% of observed vulnerabilities related to initial access
• 304 incidents linked to DPRK-nexus adversary FAMOUS CHOLLIMA, with 40% involving insider threats

Positive

• Strong market positioning in identifying and tracking cyber threats
• Enhanced AI-powered protection capabilities through Falcon platform
• Comprehensive threat intelligence covering 250+ named adversaries

Negative

• Rapidly evolving threat landscape requiring constant platform updates
• Increasing sophistication of malware-free attacks challenging detection
• Growing complexity of cyber threats from state-sponsored actors

Insights

Cybersecurity Analyst

CrowdStrike's 2025 Global Threat Report reveals significant shifts in the threat landscape that directly validate the company's business strategy and market positioning. The 150% surge in Chinese cyber espionage targeting critical industries, combined with the 442% increase in AI-powered vishing attacks, creates substantial tailwinds for CrowdStrike's growth trajectory.

The report's most financially significant finding is the dramatic shift toward malware-free attacks (now 79% of initial access breaches) and cross-domain threats that exploit gaps across endpoint, cloud, and identity. This trend directly validates CrowdStrike's unified platform approach and investments in identity protection—a key differentiator from competitors still offering fragmented security solutions.

For enterprise customers, the record-breaking breakout time of just 48 minutes (with the fastest at 51 seconds) creates urgency to adopt platforms capable of real-time detection and automated response. This pressure will likely accelerate migration away from legacy security vendors toward comprehensive platforms like Falcon.

From an investor perspective, these findings suggest CrowdStrike is well-positioned to capture increased security spending, particularly in the identity protection segment where traditional endpoint solutions fall short. The report effectively demonstrates why enterprises need CrowdStrike's integrated approach rather than point solutions from multiple vendors.

While the report serves as effective marketing for CrowdStrike's solutions, it also highlights genuine security trends that create legitimate business opportunities. As organizations recognize the inadequacy of traditional security approaches against these evolved threats, CrowdStrike's platform strategy becomes increasingly compelling for both new customer acquisition and expanded module adoption among existing customers.

Financial Analyst

CrowdStrike's 2025 Global Threat Report strategically reinforces the company's expanding market opportunity while highlighting why enterprises need their unified platform approach. The documented 150% surge in Chinese cyber operations and shift toward malware-free attacks directly supports CrowdStrike's expansion beyond endpoint security.

From a revenue perspective, these findings particularly validate CrowdStrike's strategic push into identity protection—a high-growth segment with $20+ billion TAM. With 79% of attacks now exploiting identity rather than using malware, enterprises face increasing pressure to consolidate their security stack with vendors who can correlate threats across domains. This trend should accelerate multi-module adoption, driving CrowdStrike's 120%+ net retention rate even higher.

The report's emphasis on cross-domain attacks also strengthens CrowdStrike's competitive positioning against both legacy endpoint vendors and point-solution providers. While competitors like SentinelOne and Microsoft are also expanding their platforms, CrowdStrike's threat intelligence capabilities—demonstrated through this report—provide a significant differentiation that justifies their premium pricing.

For investors, these threat trends suggest CrowdStrike can maintain strong growth despite its $90+ billion market cap. The record-breaking breakout times create urgency that should support continued 35-40% revenue growth in the near term as enterprises prioritize security modernization.

However, competition remains intense. Microsoft continues leveraging its installed base to gain security market share, while Palo Alto Networks offers an alternative platform approach. The key financial metric to watch will be gross margins, which could face pressure as CrowdStrike expands into adjacent security segments that may have different economics than their core endpoint business.

The industry’s preeminent source on adversary intelligence exposes a 442% increase in vishing as GenAI-driven social engineering attacks increase; DPRK insider threats spike

AUSTIN, Texas--(BUSINESS WIRE)-- CrowdStrike (NASDAQ: CRWD) today released its 2025 Global Threat Report, exposing the growing aggression of China’s cyber operations, a surge in GenAI-powered social engineering and nation-state vulnerability research and exploitation, and a sharp increase in malware-free, identity-based attacks. The report reveals that China-nexus adversaries escalated state-sponsored cyber operations by 150%, with targeted attacks in financial services, media, manufacturing and industrial sectors soaring up to 300%.

At the same time, adversaries worldwide are weaponizing AI-generated deception, exploiting stolen credentials and increasingly executing cross-domain attacks—exploiting gaps across endpoint, cloud and identity—to bypass security controls and operate undetected in the shadows. The shift to malware-free intrusions that exploit trusted access, combined with record-shattering breakout times, leaves defenders little room for error. To stop modern attacks, security teams need to eliminate visibility gaps, detect adversary movement in real-time and stop attacks before they escalate—because once they’re inside, it’s already too late.

CrowdStrike Global Threat Report Highlights

Tracking more than 250 named adversaries and 140 emerging activity clusters, CrowdStrike’s latest research reveals:

• China’s Cyber Espionage Grows More Aggressive: CrowdStrike identified seven new China-nexus adversaries in 2024, fueling a 150% surge in espionage attacks, with critical industries seeing up to a 300% spike in targeted attacks.
• GenAI Supercharges Social Engineering: AI-driven phishing and impersonation tactics fueled a 442% increase in voice phishing (vishing) between H1 and H2 2024. Sophisticated eCrime groups like CURLY SPIDER, CHATTY SPIDER and PLUMP SPIDER leveraged social engineering to steal credentials, establish remote sessions and evade detection.
• Iran Utilizes GenAI for Vulnerability Research and Exploitation: In 2024, Iran-nexus actors increasingly explored GenAI for vulnerability research, exploit development and patching domestic networks, aligning with government-led AI initiatives.
• From Breaking In to Logging In – Surge in Malware-Free Attacks: 79% of attacks to gain initial access are now malware-free while access broker advertisements surged 50% YoY. Adversaries exploited compromised credentials to infiltrate systems as legitimate users, moving laterally undetected with hands-on keyboard activities.
• Insider Threats Continue to Rise: DPRK-nexus adversary FAMOUS CHOLLIMA was behind 304 incidents uncovered in 2024. 40% involved insider threat operations, with adversaries operating under the guise of legitimate employment to gain system access and carry out malicious activity.
• Breakout Time Hits Record Speed: The average eCrime breakout time dropped to 48 minutes, with the fastest recorded at 51 seconds—leaving defenders little time to react.
• Cloud Environments Under Siege: New and unattributed cloud intrusions increased by 26% YoY. Valid account abuse is the primary initial access tactic, accounting for 35% of cloud incidents in H1 2024.
• Unpatched Vulnerabilities Remain a Key Target: 52% of vulnerabilities observed were related to initial access, reinforcing the critical need to secure entry points before adversaries establish persistence.

“China’s increasingly aggressive cyber espionage, combined with the rapid weaponization of AI-powered deception, is forcing organizations to rethink their approach to security,” said Adam Meyers, head of counter adversary operations at CrowdStrike. “Adversaries exploit identity gaps, leverage social engineering and move across domains undetected—rendering legacy defenses ineffective. Stopping breaches requires a unified platform powered by real-time intelligence and threat hunting, correlating identity, cloud and endpoint activity to eliminate the blind spots where adversaries hide.”

CrowdStrike pioneered adversary-driven cybersecurity through the CrowdStrike Falcon® cybersecurity platform, which delivers AI-powered protection, real-time threat intelligence and expert threat hunting to secure identity, cloud and endpoint as the gold standard in cybersecurity. Leveraging innovative behavioral AI and machine learning trained on industry-leading threat intelligence and trillions of security events, CrowdStrike delivers real-time protection against advanced threats, providing comprehensive visibility and protection across the entire attack lifecycle.

Additional Resources:

• Download the 2025 CrowdStrike Global Threat Report.
• Visit CrowdStrike’s Adversary Universe for the internet’s definitive source on adversaries.
• Listen to the Adversary Universe podcast to glean insights into threat actors and recommendations to amplify security practices.

About CrowdStrike

CrowdStrike (NASDAQ: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk – endpoints and cloud workloads, identity and data.

Powered by the CrowdStrike Security Cloud and world-class AI, the CrowdStrike Falcon® platform leverages real-time indicators of attack, threat intelligence, evolving adversary tradecraft and enriched telemetry from across the enterprise to deliver hyper-accurate detections, automated protection and remediation, elite threat hunting and prioritized observability of vulnerabilities.

Purpose-built in the cloud with a single lightweight-agent architecture, the Falcon platform delivers rapid and scalable deployment, superior protection and performance, reduced complexity and immediate time-to-value.

CrowdStrike: We stop breaches.

Learn more: https://www.crowdstrike.com/
Follow us: Blog | Twitter | LinkedIn | Facebook | Instagram
Start a free trial today: https://www.crowdstrike.com/free-trial-guide/

© 2025 CrowdStrike, Inc. All rights reserved. CrowdStrike and CrowdStrike Falcon are marks owned by CrowdStrike, Inc. and are registered in the United States and other countries. CrowdStrike owns other trademarks and service marks and may use the brands of third parties to identify their products and services.

View source version on businesswire.com: https://www.businesswire.com/news/home/20250227012922/en/

Jake Schuster

CrowdStrike Corporate Communications

press@crowdstrike.com

Source: CrowdStrike

FAQ

What is the percentage increase in China's cyber espionage attacks according to CrowdStrike's 2025 report?

According to the report, China-nexus adversaries increased state-sponsored cyber operations by 150%, with some sectors experiencing up to 300% increase in targeted attacks.

How much did AI-driven voice phishing (vishing) attacks increase in 2024?

Voice phishing attacks increased by 442% between the first and second half of 2024, driven by AI-powered social engineering tactics.

What percentage of cyberattacks are now malware-free according to CRWD's 2025 report?

79% of attacks to gain initial access are now malware-free, with adversaries using compromised credentials to infiltrate systems as legitimate users.

What is the average breakout time for eCrime attacks in 2025?

The average eCrime breakout time dropped to 48 minutes, with the fastest recorded attack taking just 51 seconds.

How much did cloud intrusions increase according to CrowdStrike's latest report?

New and unattributed cloud intrusions increased by 26% year-over-year, with valid account abuse accounting for 35% of cloud incidents in H1 2024.