56 percent of security incidents caused by lack of MFA
Valid account credentials -- with no MFA in place to protect the organization should they be
misused -- are still by far and away the biggest stumbling block for organizations investigated
by the Rapid7 IR team, occurring in 56 percent of all incidents in the first quarter of 2025.
Exposed RDP services account for six percent of incidents as the initial access vector (IAV) and were abused by attackers more generally in 44 percent of incidents.
In addition 44 percent of investigated incidents in the first three months of this year have involved ransomware, with the majority involving vulnerability exploits, and/or MFA related compromises. These include a surprising diversity of ransomware groups, such as Black Basta, INC Ransomware, Akira, Qilin, and RansomHub.
The BunnyLoader, the Malware as a Service (MaaS) loader, which has a wealth of capabilities
including clipboard and credential theft, keylogging, and the ability to deploy additional malware, is one of the most prolific presences Rapid7 has seen the first quarter. In many cases, it's also daisy-chained to many of the other payloads and tactics which make repeated appearances.
Manufacturing organizations were targeted in more than 24 percent of incidents observed, making it the most attacked. Manufacturing is a popular attack vector for nation states because it's an important component of global trade. It's also an area that has many legacy and older, operational technologies.
Chris Boyd, lead threat researcher at Rapid7, writes on the company's blog, "In addition, the risk of severe compromise stemming from seemingly harmless online searches underscores the necessity for organizations to reexamine basic security best practices, alongside deploying robust detection and response capabilities. Businesses addressing these key areas for concern will be better equipped to defend against what should not be an inevitable slide into data exfiltration and malware deployment."
You can read more on the Rapid7 blog.
Image credit: Jirsak/depositphotos.com