Adios 2025, you won’t be missed
Summary: Cisco Talos' year-end Threat Source newsletter recounts 2025 through a Talos Takes episode that traced how ransomware expanded via the as-a-service model, why identity became the main battleground, and how the lines between state-sponsored actors and APTs have blurred. The same issue notes in-the-wild exploitation of Fortinet flaws CVE-2025-59718 and CVE-2025-59719 (CVSS 9.8), a French Interior Ministry email server compromise detected overnight between December 11 and 12, and an AWS crypto mining campaign using compromised IAM credentials first detected November 2, 2025.
Key Takeaway: Talos' own summary is that the ransomware industry is bigger and nastier than ever, with attackers more organized, efficient and professionalized - and its recommended response is doubling down on identity and access management, including the service accounts that keep multiplying.