NTT DATA Identifies a Paradigm Shift in Cyber Threats: Attacks Are Now More Persistent, Stealthy, and Strategic

The second-half 2025 edition of the Threat Cyber Intelligence Report reveals a fundamental shift in attack models—marked by stealthier intrusions, rising geopolitical influence, and the increasing professionalization of cybercrime.

The global cyber threat landscape is undergoing a structural transformation. According to the Threat Cyber Intelligence Report published by NTT DATA for the second half of 2025, threat actors are shifting toward low-profile, sustained intrusions designed to maximize economic, strategic, and reputational damage. The focus has moved beyond immediate disruption—toward persistence, stealth, and the ability to maintain long-term control over compromised systems.

The findings reveals that cyberspace now operates as a strategic domain where economic, political, and security conflicts converge. Geopolitical tensions, technological fragmentation, and realigned international alliances directly impact digital infrastructure, supply chains, and critical sectors. Attribution has become more difficult, cross-border cooperation more complex, and risk exposure significantly higher for governments, key industries, and private enterprises. Cyberspace has also emerged as a default arena for indirect confrontation—where state and non-state actors apply pressure and generate disruption well short of open military conflict.

Artificial intelligence has become a critical force multiplier in this shift. Its integration into cyber espionage, disinformation operations, and offensive automation lowers barriers to entry, compresses attack cycles, and extends the reach of hybrid campaigns—whether conducted by nation-states or advanced criminal organizations.

The criminal ecosystem has decentralized. The dismantling of major underground forums and centralized marketplaces did not reduce illicit activity—it dispersed it across specialized markets, initial access brokers, and increasingly opaque private channels, severely complicating threat monitoring and early intelligence efforts.

Ransomware and data-driven extortion have reached full operational maturity. Current campaigns blend automation, targeted exfiltration of sensitive data, staged public pressure, and reputational exploitation. “Silent” techniques now dominate—particularly the abuse of legitimate cloud and SaaS platforms—allowing threat actors to persist and move laterally with virtually no trace.

A sector-level analysis shows that the most targeted industries during the period were government and public administration (3,343 attacks), education (1,140), financial services (957), information technology (802), and telecommunications (614). The estimated global economic impact of cybercrime now stands at $10.5 trillion per year.

Stronger regulatory frameworks, high-impact international law enforcement operations, and improved organizational defenses represent real progress—but threat actors continue to adapt faster than defenses can keep up. A persistent gap remains between regulatory compliance and genuine operational resilience.

“This is a paradigm shift. Attacks no longer aim to disrupt—they aim to shape decisions, processes, and long-term strategy. Effective risk management now requires a comprehensive approach built on contextual detection, resilience, and strategic anticipation of persistent, highly adaptive threats,” says María Pilar Torres Bruna, Head of Cybersecurity, NTT DATA Iberia, International Organisations, LATAM and Consulting in Benelux and France.

The report's conclusion is clear: compliance is not resilience. Organizations that treat cybersecurity as a checkbox exercise will fall behind. Those that embed it as a strategic function—driven by risk anticipation, contextual intelligence, and operational agility—will be positioned to withstand what comes next.