Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

In mid-May 2025, Cloudflare blocked the largest DDoS attack ever recorded: a staggering 7.3 terabits per second (Tbps). This comes shortly after the publication of our DDoS threat report for 2025 Q1 on April 27, 2025, where we highlighted attacks reaching 6.5 Tbps and 4.8 billion packets per second (pps). The 7.3 Tbps attack is 12% larger than our previous record and 1 Tbps greater than a recent attack reported by cyber security reporter Brian Krebs at KrebsOnSecurity.

In Q2 2025, Scattered Spider has been noted as a prolific threat actor targeting several sectors across multiple countries. As of June 2025, the group appears to have moved towards targeting the insurance sector. This is not novel victimology within the landscape, with attacks consistently targeting the sector, particularly in the extortion sphere. This blog explores the attacks Scattered Spider has conducted in 2025, as well as similar attacks around the insurance sector in the year.

Most organizations assume a clear boundary between external users, who submit support tickets or service requests, and internal users, who handle them using privileged access. However, when an internal user triggers an AI action from a model context protocol (MCP) tool, such as summarizing a ticket, that boundary can break.

Technology plays a vital role in supplier networks and digital ecosystems today. While supply chains used to be primarily physical, digitalization has improved efficiency but also introduced new cybersecurity risks that are often overlooked. As software and digital service providers are often integrated into organizations’ environments, they have become prime targets for cybercriminals looking to scale their attacks.

Phishing remains one of the biggest cyber threats in circulation today. Billions of emails are sent every single day and together they claim thousands of victims, whether businesses or private individuals. Yet if the phishing attack is so well known, why do most people still fall for the trick? CSO Online reports that 80% of all security incidents are attributed to phishing.

Microsoft introduced AMSI (Antimalware Scan Interface) with Windows 10 in 2015. This interface standard allows third-party security products to be integrated with applications running on a Windows PC to improve detections for fileless and script-based attacks. Naturally, adversaries immediately began efforts to defeat AMSI.