Stolen Passwords Remain Hackers’ Top Tactic: Kaspersky
Despite the evolving nature of cyberattacks, the misuse of user accounts and passwords remains one of the most effective tactics employed by cybercriminals, according to global cybersecurity company Kaspersky.
The company's latest report, titled “Anatomy of a Cyber Attack 2025,” found that most successful cyber incidents continue to be driven by stolen or weak passwords and the abuse of legitimate user accounts.
According to the report, the most frequently observed activities in identified cyber incidents included password-guessing attempts (34.8 percent), creation of new local accounts (34.7 percent), unauthorized access through valid accounts (34.5 percent), account modifications (32 percent), and reconnaissance activities aimed at gathering information about network services and systems (31.2 percent).
The report was compiled using data collected through Kaspersky’s Managed Detection and Response (MDR), Incident Response, Compromise Assessment, and Security Operations Center (SOC) Consulting services.
The research revealed that cybercriminals often rely on techniques that closely resemble legitimate user behavior. This enables them to gain access to systems, remain undetected for extended periods, and move laterally across different parts of a network. As a result, weak passwords and inadequate monitoring of account-based activities continue to pose significant security risks.
Sergey Soldatov, Head of Kaspersky’s Security Operations Center, said, “Cybercriminals do not always need sophisticated malware to achieve their objectives. In many cases, legitimate administrative tools and compromised accounts provide the simplest and most effective path. By using these techniques, they can move through corporate networks without being easily detected. Therefore, strengthening the ability to rapidly identify and analyze suspicious activities is critically important.”
He further noted that effective security measures and rapid response capabilities can play a crucial role in reducing cyber risks.
DBTech/SS/EK/OR
