February 2025 Cyber Threat Intelligence Reports

A detailed overview of reported cyber threats and their Admiralty ratings for February 2025

cybersecurity screens, server room, digital data streams

Key Highlights

Comprehensive Coverage: Reports span nation-state campaigns, vulnerabilities, and financially motivated attacks across multiple regions.
Admiralty Ratings: Each report is assessed using the Admiralty (NATO) system, ensuring reliability and credibility ratings from A1 to lower grades.
Diverse Sources: This overview covers weekly, monthly, and special reports, highlighting trends from phishing campaigns, malware attacks, and critical vulnerabilities.

Overview of February 2025 Cyber Threat Intelligence Reports

Throughout February 2025, numerous cyber threat intelligence reports have been published, detailing various emerging threat trends, vulnerabilities, and nation-state activities. Each report employs the Admiralty rating system—assessing both the reliability of the source and the credibility of the information—to provide decision-makers with a clear understanding of the threat landscape. In the following sections, we provide an integrated analysis of these reports, with a focus on summarizing key details including report dates, threat summaries, Admiralty ratings, and direct links to the sources.

Weekly and Regular Reports

Weekly intelligence reports offer timely insights into specific threats. Among these, several reports detailed phishing campaigns, vulnerabilities exploited in widely-used software, and advanced persistent threat (APT) activities. Notable reports include:

Check Point Research Reports

Multiple reports from one leading cybersecurity entity provide in-depth coverage of Russian threat actors, targeted phishing campaigns, and the exploitation of vulnerabilities in widely used systems. For example:

10th February Report: This report highlighted attacks involving SmokeLoader malware deployed via phishing emails, primarily targeted at Ukrainian organizations. The thorough exploration in this report secured an Admiralty rating of A1, indicating completely reliable and confirmed information.
3rd February Report: Focusing on breaches that affected companies involved in financial and operational sectors – including incidents at a community health center and data breaches involving well-known brands – this report maintained the same high reliability as the other publications, rated at A1.
24th February Report: Addressing critical issues such as the high-profile ByBit hack, a breach at a major investment firm, and compromises resulting from the exploitation of Microsoft Power Pages (CVE-2025-24989), this report also received an A1 Admiralty rating.

CYFIRMA Weekly Intelligence Reports

CYFIRMA published weekly reports that discuss evolving cyber threat tactics. Their findings include:

20 February Report: This report provided a comprehensive analysis of ongoing threats, including nation-state operations by North Korean APT groups and Russian threat actors targeting cloud services. Its Admiralty rating of B2 reflects its reliability and the fact that some aspects are yet to be confirmed across multiple channels.
14 February Report: With a focus on financial motives behind malware campaigns, this report detailed attacks (such as the exploitation of vulnerabilities in web servers) with an Admiralty rating of B2.

PacketWatch Cyber Threat Intelligence

Focusing on software vulnerabilities, one report from PacketWatch on 24 February 2025 detailed an SSH vulnerability that allows threat actors to bypass host verification, facilitating session hijacking and credential theft. With an Admiralty rating of A1, it underscores the severity of such exploits and the reliability of the research.

Monthly and Special Reports

Monthly and special reports provide broader overviews and deeper analyses of the threat landscape, incorporating trends over longer periods. These include:

Gatewatcher Cyber Threats Barometer

The monthly report from Gatewatcher offers a comprehensive overview of evolving cyber threats as detected by their Cyber Threat Intelligence platform. Emphasizing vulnerabilities in sectors prioritizing rapid innovation, particularly within the AI industry, this report is rated A1 in Admiralty for its confirmed and reliable insights.

Red Canary Intelligence Insights

Focused on threats emerging from malicious Chrome extensions and targeted payload delivery attacks, the Red Canary report from February 2025 identifies campaigns such as "Infrared Ibis" and "Saffron Starling." The analysis provided herein has earned an Admiralty rating of B1, signifying a highly reliable report with partial confirmation from other sources.

Group-IB Intelligence Insights

Group-IB released dual regional reports covering North America and the META region, respectively. These reports address evolving cyber challenges and emerging tactics by threat actors active in those regions. Their detailed exploration of cross-border cyber threats has resulted in Admiralty ratings in the range of B1 for North America and comparable ratings for the META analysis.

Truesec 2025 Threat Intelligence Report

This report puts a spotlight on the global cybersecurity landscape with a focus on innovative hybrid warfare strategies and fiscal cyber-attacks in the Nordic and global sectors. The report’s extensive data gathering and analytical depth result in a rating of A1 in the Admiralty system.

OpenAI’s Update on Disrupting Malicious Uses of Our Models

Although primarily focused on misuse of advanced AI models, this update discusses disruptions caused by threat actors, including those originating from China. Proven to be a reliable source of intelligence, the update carries an Admiralty rating of A2.

RST TI Report Digest

Featuring a summary of up to 50 different threat intelligence reports, this digest offers a meta perspective on current cybersecurity trends. Due to its summarizing nature and potential for less granular detail, it is rated at B2 in Admiralty, with some sources rating it slightly lower at C3 in other iterations.

NCC Group Cyber Threat Intelligence Reports

Additionally, an upcoming webinar by NCC Group, which was advertised to cover new threat actors and cyber threats expected on February 25, 2025, complements this ecosystem of intelligence. The pre-event information is rated at a more tentative level, such as B3, considering future validation upon release.

Integrated Report Table

Below is a consolidated table summarizing the key details of each cyber threat intelligence report from February 2025:

Report Title	Date	Focus/Summary	Admiralty Rating	Source Link
Check Point Research 10th Feb Report	10 Feb 2025	SmokeLoader phishing attacks targeting Ukrainian organizations	A1	Source Link
Check Point Research 3rd Feb Report	03 Feb 2025	Various breaches including data compromises for community health centers	A1	Source Link
Check Point Research 24th Feb Report	24 Feb 2025	ByBit hack; misuse of Microsoft Power Pages vulnerability and related breaches	A1	Source Link
CYFIRMA 20 Feb Weekly Report	20 Feb 2025	Nation-state campaigns including activities by North Korean and Russian actors	B2	Source Link
CYFIRMA 14 Feb Weekly Report	14 Feb 2025	Financially motivated attacks; exploitation of web infrastructure vulnerabilities	B2	Source Link
PacketWatch SSH Vulnerability Report	24 Feb 2025	SSH session hijacking vulnerability with bypass of host verification	A1	Source Link
Gatewatcher Cyber Threats Barometer	February 2025	Sector-specific vulnerabilities including those in AI innovation	A1	Source Link
Red Canary Intelligence Insights	February 2025	Campaigns involving malicious Chrome extensions and payload distribution	B1	Source Link
Group-IB Insights: North America	February 2025	Emerging cybersecurity challenges in the North American landscape	B1	Source Link
Group-IB Insights: META	February 2025	Cybersecurity challenges in the Middle East and Africa regions	B1	Source Link
Truesec 2025 Threat Intelligence Report	February 2025	Global trends with a focus on Nordic cybersecurity and hybrid warfare	A1	Source Link
OpenAI Malicious Models Update	February 2025	Disruptions involving threat actors from China misusing AI models	A2	Source Link
RST TI Report Digest	24 Feb 2025	Summary of multiple threat intelligence reports and associated metadata	B2 / C3	Source Link
NCC Group Webinar (Announcement)	25 Feb 2025 (Upcoming)	Preview of discussions on new threat actors and evolving cyber threats	B3	Source Link

Conclusion

In conclusion, February 2025 featured a robust collection of cyber threat intelligence reports, each evaluated with the Admiralty rating system to offer clear insights into their reliability and confirmed credibility. From deep dives into specific vulnerabilities and nation-state campaign tactics to broader monthly overviews, these reports collectively present a picture of an increasingly complex cyber threat landscape. The value of these reports lies in their ability to guide cybersecurity professionals and decision-makers as they strategize defenses against both emerging and persistent threats.

The integrative assessment provided here underscores the multifaceted nature of modern cyber threats, with multiple entities consistently reporting on overlapping themes, whether it is the sophisticated use of phishing tactics, exploitation of software vulnerabilities, or innovative use of hybrid warfare strategies. The Admiralty ratings further empower stakeholders to prioritize actions based on a nuanced understanding of source reliability and the credibility of the information offered.

Ultimately, leveraging a diverse set of reports enhances situational awareness and ensures that cybersecurity readiness is maintained against dynamic and evolving challenges.