2025's ransomware trends and zombie vulnerabilities

In this episode of Talos Takes, Amy and research lead Pierre Cadu dive into the 2025 Talos Year in Review, focusing on ransomware trends and persistent vulnerabilities. Manufacturing remains the top target due to high downtime tolerance and increasing convergence between IT and OT networks, creating new attack surfaces. Ransomware groups like Chilin, Akira, and Play maintained long-term momentum through consistent tactics, use of 'living off the land' tools, and effective affiliate compensation. The episode highlights how adversaries exploit standard admin tools like RDP, PSExec, and PowerShell, making visibility and context crucial for detection. January, traditionally a quiet month for ransomware, offers a rare window for defenders to reassess and retool—but the team stresses that proactive security should be continuous, not seasonal. The discussion then shifts to 'zombie vulnerabilities' like Log4J, which remain exploitable years after disclosure due to poor asset management and embedded legacy code. Finally, network infrastructure targets such as ADCs and VPNs are prized by attackers for their access to network architecture and authentication systems, especially when weak or single-factor authentication is in place. The episode concludes with a call to action: leverage the freely available year-in-review report to strengthen defenses.