The start of 2025 started with a noticeable uptick in brute-force attacks targeting public-facing services. Among the most frequent vectors were VPN portals and Microsoft 365 logins, with attackers relentlessly attempting to guess weak or reused credentials.

A significant portion of the hostile activity tracked in January was attributed to threat actors originating from Russia. Interestingly, in a growing trend to evade traditional geo-blocking defences, many of these actors leveraged Virtual Private Servers (VPS) from local or regional hosting providers. By doing so, they manage to blend in with legitimate traffic and bypass geo-fencing restrictions that organizations may have in place.

Alongside brute-force attempts, phishing attacks remained also a persistent threat. A common tactic seen was the impersonation of official authorities — most often, emails crafted to look like they came from police departments, courts, or other legal institutions. These phishing emails were designed to give a sense of urgency or fear, often claiming the recipient was involved in a legal matter or needed to respond to an official inquiry.

Once engaged, these emails typically lead to multi-stage infection chains. In many cases, the initial file or link triggered a series of downloads, often obscured through obfuscation or staged delivery methods, which helps bypass basic antivirus and email security filters. The end goal of these campaigns seem to be usually an infostealer malware.