Cyber threats are growing in complexity and impact, with 2024 seeing a sharp rise in credential theft and advanced malware. The Picus Red Report 2025 sheds light on these alarming trends, revealing actionable insights for organisations such as schools, small businesses, and charities – sectors often targeted due to limited cyber security resources. Black Swan Cyber Security Solutions is committed to helping these organisations navigate this challenging landscape.
Key findings from the Picus Red Report
1. Credential theft tripled in 2024
Credential theft surged by 300%, with attacks on password stores becoming one of the top 10 techniques in the MITRE ATT&CK framework. This tactic accounted for 25% of malware samples analysed. Cyber criminals leveraged tools to extract credentials from browser-stored caches, and system memory, allowing them to escalate privileges and infiltrate sensitive systems.
2. Rise of “SneakThief” malware
Described as executing “The Perfect Heist,” SneakThief malware represents a new era of adversarial sophistication. Combining stealth, persistence, and automation, SneakThief mirrored real-world incidents, targeting legitimate applications and bypassing traditional defences. This advanced malware performed over a dozen malicious actions, including process injection, encrypted communication, and boot persistence, ensuring long-term access to compromised systems.
3. 93% of malicious actions linked to top 10 techniques
Over 93% of cyber attacks utilised the top 10 MITRE ATT&CK techniques. Among the most prevalent were:
Process injection (T1055): Embedding malicious code into legitimate processes to evade detection.
Command and scripting interpreter (T1059): Using native tools like PowerShell to execute malicious scripts.
Credentials from password stores (T1555): Stealing stored login data to gain lateral access.
4. Stealth and persistence dominate
Modern malware employs evasion techniques, including encrypting communications and exploiting boot or logon autostart mechanisms, ensuring long-term undetected access. Tools such as keyloggers and screen capture utilities are increasingly used to steal sensitive information in real time.
5. AI in malware: Hype vs reality
Despite fears of AI-driven malware, the report found no significant use of AI for malicious purposes beyond productivity enhancements like phishing content generation.
Why schools, small businesses and charities are at risk
These sectors are prime targets due to:
Limited resources: Many lack dedicated IT staff or cyber security budgets.
High-value data: Schools manage sensitive student records, while businesses and charities hold financial and donor information.
Reliance on digital tools: Increasing use of online platforms for education, operations, and fundraising creates vulnerabilities.
Credential theft can lead to data breaches, financial fraud, and reputational damage, all of which can be catastrophic for organisations with constrained resources.
How Black Swan Cyber Security Solutions can help
At Black Swan, we specialise in tailored, budget-conscious cyber security solutions for schools, small businesses, and charities. Here’s how we address the threats highlighted in the Red Report:
1. Strengthening credential protection
Multi-Factor Authentication (MFA): Adding an extra layer of security to login processes.
Secure password management: Protecting stored credentials and regularly auditing access.
Privileged access management (PAM): Restricting and monitoring high-level access to critical systems.
2. Defending against advanced malware
Endpoint Detection and Response (EDR): Monitoring for suspicious activity and isolating threats in real time.
Application control: Limiting script execution to prevent abuse of tools like PowerShell.
Behavioral analytics: Detecting anomalies indicative of stealthy malware operations.
3. Enhancing backup and recovery
Immutable backups: Ensuring data remains secure and unalterable, even during a ransomware attack.
Disaster recovery planning: Helping organisations bounce back quickly with minimal disruption.
4. Real-time threat detection
- Data Loss Prevention (DLP): Blocking unauthorised attempts to move sensitive data.
Phishing Simulations: Educating staff to recognise and report phishing attempts.
5. Proactive threat hunting
Using the MITRE ATT&CK framework as a guide, we focus on:
Early detection of infiltration attempts.
Regular audits to uncover hidden vulnerabilities.
Continuous improvement of defense mechanisms.
The importance of collaboration
No organisation can address these threats alone. At Black Swan, we act as an extension of your team, providing expertise and tools to safeguard your operations. Our nearly 20 years of experience ensures that you receive trusted advice and practical solutions tailored to your unique needs.
Taking the next step
The findings from the Picus Red Report 2025 are a wake-up call for schools, small businesses, and charities. Cyber criminals are more persistent and sophisticated than ever, but with the right strategies, you can stay ahead. Black Swan Cyber Security Solutions is here to help you build a secure future.
Let’s talk about how we can protect your organisation. Contact us today for a consultation.
