Understanding the Most Frequently Encountered Malware and Abused Software: Insights from the Sophos 2025 Threat Report

As the cybersecurity landscape evolves, attackers are no longer just deploying ransomware. They’re exploiting legitimate tools, stealing credentials, and using stealthier malware — all with increasing sophistication. The Sophos 2025 Threat Report provides a vital snapshot of the most common threats seen in real-world environments over the past year.

In this article, we break down the report’s findings — and explain how BetterWorld Technology is actively defending clients against these exact threats.

A Rapidly Shifting Threat Landscape

Sophos analyzed thousands of incident response cases and security alerts to identify the top categories of malware and abused software. The results paint a clear picture: threat actors are diversifying their tactics and combining multiple attack vectors.

Here’s a breakdown of the most frequently encountered threats in 2024:

Threat Category	% of Cases (Approx.)	Key Examples
Ransomware	25%+	LockBit, Akira, BlackCat, RansomHub
Loaders / Downloaders	~20%	Gootloader, ChromeLoader
Information Stealers	~15%	Lumma Stealer, RedLine Stealer
Dual-Use Legitimate Tools	~20%	AnyDesk, ScreenConnect, PSExec, Mimikatz
Remote Access Trojans (RATs)	~10%	AsyncRAT, njRAT, Remcos RAT

Ransomware: Still a Primary Threat

Although ransomware made up just over a quarter of cases, it remains the most impactful and disruptive threat category. Groups like LockBit and Akira continue to evolve, combining data encryption with double extortion tactics — stealing data before locking systems, then demanding payment for both decryption and to prevent leaks.

BetterWorld’s approach: We proactively defend clients with real-time endpoint monitoring, behavioral threat detection, and automated response plans. We’ve successfully prevented encryption attempts by isolating endpoints at the first sign of compromise.

Loaders and Downloaders: The Silent Enablers

Loaders, such as Gootloader and ChromeLoader, often arrive via malicious ads, phishing emails, or drive-by downloads. Once inside a system, they act as delivery mechanisms, quietly installing additional malware like spyware, stealers, or ransomware.

These tools often go undetected until the actual payload is executed — giving attackers a critical window to escalate privileges or exfiltrate data.

BetterWorld’s edge: Our MDR team uses anomaly-based detection models that flag abnormal script behavior, often stopping loaders before secondary payloads can deploy.

Information Stealers: The Quiet Data Thieves

In 2024, Lumma Stealer became one of the most commonly used malware tools. It targets browser-stored credentials, session cookies, banking information, and crypto wallet keys. These credentials are then sold or used for deeper network infiltration.

Stealers are especially dangerous because they leave no visible footprint — no encrypted files, no locked screens — but the damage to data privacy and compliance can be massive.

How we help: BetterWorld helps clients minimize attack surfaces with browser policy hardening, credential vaulting, and regular phishing simulation training to reduce successful entry points.

Abused Software: The Rise of Dual-Use Tools

One of the most concerning trends is the abuse of legitimate IT tools. Attackers use software like AnyDesk or ScreenConnect (commonly installed for remote support) to maintain access after initial intrusion. Tools like PSExec and Mimikatz are also used for lateral movement and credential dumping, respectively.

These aren’t malware in the traditional sense — which makes them harder to detect and block without impacting IT operations.

BetterWorld’s controls: We deploy application allowlisting, privilege monitoring, and alert our clients the moment dual-use tools are activated outside their expected scope.

Remote Access Trojans: Hidden Persistence

RATs (Remote Access Trojans) like AsyncRAT and njRAT give threat actors full control over a victim’s device — allowing them to log keystrokes, view webcams, download files, and maintain persistence for weeks or months undetected.

RATs are often deployed after the attacker has already compromised the system, making them particularly dangerous in post-breach environments.

Our strategy: BetterWorld monitors for unusual network beaconing behavior, blocks known RAT command-and-control domains, and uses endpoint sandboxing to flag unusual payload execution.

What This Means for Your Business

If your organization operates with internet-connected systems — whether you’re in professional services, healthcare, finance, or non-profit — you are a potential target. The variety and accessibility of these tools mean attackers can custom-build attacks tailored to your infrastructure.

BetterWorld Technology doesn’t just react. We protect your business with layered defense, human-led threat hunting, and a proven track record of successful incident prevention and response.

Stay Informed, Stay Protected

The key takeaway from the 2025 Sophos report is this: the tools cybercriminals use are changing fast, but their goals remain the same — access, control, and monetization of your data and systems.

That’s why at BetterWorld Technology, our mission is to give you peace of mind through:

• Advanced threat detection and response

• Hands-on remediation and recovery

• Security awareness training for your staff

• Custom-fit security roadmaps tailored to your risk profile

  
  

Ready to strengthen your cybersecurity before threats strike? Let’s talk strategy.

Contact BetterWorld Technology today to schedule your custom threat assessment and ensure your defenses are built to stop what’s next.

FAQs

What are the most common types of malware businesses faced in 2024?

According to the Sophos 2025 Threat Report, the most common types of malware included ransomware attacks (like LockBit and Akira), loaders and downloaders (such as Gootloader), information stealers (notably Lumma Stealer), and Remote Access Trojans (RATs) like AsyncRAT. Attackers also frequently abused legitimate IT tools like AnyDesk and PSExec to maintain persistent access.

How do cybercriminals use legitimate software like AnyDesk and PSExec in attacks?

What is an information stealer, and why are they dangerous to businesses?

How does BetterWorld Technology protect businesses against ransomware and other malware?

Why is 24/7 threat monitoring critical for modern cybersecurity?