APT and Financial Attacks on Industrial Organizations in Q2 2025

This technical report provides an overview of advanced persistent threat (APT) and financial attacks on industrial organizations reported in the second quarter of 2025. It details the activities of various threat actors targeting industrial enterprises and critical infrastructure. The report outlines the use of sophisticated tactics, including the exploitation of zero-day vulnerabilities by groups such as Lazarus and Stealth Falcon, which targeted high-profile organizations in Russia and Turkey. Additionally, it discusses the prevalence of basic cybersecurity failures, exemplified by the injection of malicious code into Microsoft Exchange Servers affecting over 65 organizations across multiple sectors. The report emphasizes the importance of maintaining basic cybersecurity measures and highlights the need for corporate training in personal cybersecurity hygiene. It concludes with a note on the evolving threat landscape, particularly regarding the activities of Cyber Partisans in Russia, indicating potential future incidents.