According to a recent global report by Kaspersky Security Services, password guessing and valid account misuse rank among the most effective tactics used by cyber criminals in 2025.

This trend reflects a strategic shift, as attackers move away from triggering endpoint protection with noisy malware, in preference of leveraging legitimate access to evade detection.

The ‘Anatomy of a Cyber World’ is an in-depth global report based on data gathered from Kaspersky Managed Detection and Response (MDR), Incident Response (IR), Compromise Assessment and SOC Consulting in 2025. It covers the most common adversary techniques, tools and detection scenarios and highlights the peculiarities of detected incidents.

According to the report, a significant portion of the most frequently monitored attack techniques revolves around credentials and identity management. This analysis, which examines the conversion rates* of various Indicators of Attack (IoA), highlights the following prevalent malicious tactics:

Password guessing – 34.8%. This technique entails attackers systematically trying different passwords until successfully gaining access to an account. It tops the conversion list due to its occurrence in both actual attacks and authorised security assessments, making it a persistent threat in today’s cybersecurity landscape. Organisations who rely on weak or reused passwords continues to enable this age-old strategy.

Local account creation – 34.7%. Once inside a system, attackers frequently create new local accounts to maintain access even if their original foothold is discovered and removed. This technique is frequently observed during security exercises and can be detected — but only with the right telemetry in place, which is often lacking.

Valid account abuse – 34.5%. Instead of deploying malware, attackers log in using stolen or compromised credentials and simply blend in with normal user activity. This makes detection significantly harder, as the access itself appears legitimate. The high conversion rate underscores why compromised credentials remain one of the most dangerous attack vectors.

Account manipulation – 32%. Attackers modify existing accounts to consolidate access such as by activating disabled accounts, altering group memberships, or escalating privileges. This reinforces the broader pattern — rather than introducing new tools, adversaries deepen their control using what is already there.

Network service discovery – 31.2%. Before moving deeper into a network, attackers typically scan for open services and systems they can reach. This reconnaissance step is a strong predictor of what follows: lateral movement and further exploitation. Detecting it early provides security teams a critical window to intervene.

The report ranks attacker techniques by how frequently observed activity ultimately resulted in confirmed malicious incidents. According to Kaspersky experts, while MITRE ATT&CK® catalogs a vast number of adversary techniques, effective detection requires prioritising behaviours with the highest probability of malicious intent while avoiding excessive false positives.

“Threat actors do not always need sophisticated malware to achieve their objectives. In many cases, legitimate administrative tools and compromised accounts remain the fastest and most effective way to move inside an organisation while avoiding detection.

The continued popularity of these techniques shows that organisations need deep visibility into attacker behaviour and the ability to correlate suspicious activity across different stages of an attack.

To address these challenges, companies can enhance their security with our solutions: Kaspersky Managed Detection and Response and Incident Response which cover the entire incident management cycle – from threat detection to continuous protection and remediation,” comments Sergey Soldatov, Head of Security Operations Center at Kaspersky.

Independent National Electoral Commission (INEC) has started looking into reports of unauthorized access to its Continuous Voter Registration (CVR) database, according to Mohammed Kudu Haruna, national commissioner and chairman of the Information and Voter Education Committee (IVEC),

Haruna, in a statement on Tuesday said that was aware of the allegations spreading on social media and in some news outlets.

“The Independent National Electoral Commission is aware of rumors currently circulating on social media and in certain media about unauthorized access to the Commission’s Continuous Voter Registration  (CVR) database.

These claims include the publication of information about a candidate from recent political party primaries in the Federal Capital Territory.

“The Commission takes this allegation very seriously and has quickly begun a thorough investigation to find out what really happened,” the statement noted.

INEC clarified that during the ongoing nationwide CVR process, registered officers were given limited access to specific parts of the registration system.

This access helps them manage voter registrations, transfer requests, and updates to voter records.

The commission stated that access to the information is only allowed for official duties and is taken away once the task ends.

Haruna revealed that initial findings from the commission’s audit trail helped pinpoint the user account used to access the information.

“The audit trail from our early investigation has allowed us to find out which user account was involved. As a result, we’ve questioned relevant staff, and all departments related to this matter are fully cooperating with the investigation,” it mentioned.

The commission also said it is looking into all technical, administrative, and operational details of the situation to figure out who is responsible and whether any internal access-control rules were broken.

However, INEC reported that its early findings indicated there was no outside breach of its systems.

Advertisement

“Our initial findings from the audit trail suggest that there was no external breach of the CVR database, no hacking incident, and no unauthorized outside access to our ICT systems.”

“Instead, the information in question was accessed using valid user credentials assigned to personnel involved in the ongoing CVR exercise but was released without proper authorization,” added the statement.

The commission emphasized that this incident involved retrieving a specific voter record and did not indicate any risk to the overall voter registration system or the personal data of over 90 million registered voters.

“The investigation is focused on the retrieval of a specific voter record and does not suggest any risk to the overall voter registration system or the personal data of over 90 million registered voters, according to the statement.

INEC emphasized that it is dedicated to safeguarding voter information and ensuring the integrity of its electoral systems.

“The Commission clearly states that it takes the security, privacy, and integrity of voter data very seriously. It remains committed to transparency, institutional integrity, and protecting voters’ personal details,” the statement noted.

The commission also announced that the Department of State Services has started its own investigation into this issue.

“Additionally, the Department of State Services has independently begun an investigation. The Commission will fully cooperate with all relevant security agencies and will not hesitate to take legal action against anyone found responsible,” the statement continued.

INEC encouraged the public and media to refrain from making assumptions while investigations are ongoing, promising that it will share its findings and any actions taken in due time.

QR codes embedded in emails have long been a tool for phishing and scams, and back in the second half of 2025 there was a fivefold surge in QR phishing attacks detected by Kaspersky.

Now Kaspersky researchers have identified a new phishing tactic in which attackers construct QR codes using text characters rather than traditional images. This method allows such malicious QR codes to bypass many email security solutions that rely on image scanning or link detection.

Early computers were incapable of rendering true graphics, and images on them were composed entirely of text characters. Historically this was done with symbols from the ASCII (American Standard Code for Information Interchange) character set, introduced in 1963. Images created using this technique were called ASCII graphics. Later other character sets (like Unicode) were also utilised to create images, but the term ASCII graphics remained.

In the 2000s, spam senders already used images built from text symbols. By using text-based graphics instead of embedded images, attackers tried to avoid detection mechanisms that analyse pictures for hidden URLs.

With ASCII graphics used to create QR codes, the phishing scheme follows a familiar pattern as with QR codes in images which Kaspersky described earlier. Victims receive an email allegedly coming from a business partner, claiming to include a confidential document for signature via DocuSign.

The message instructs the recipient to scan a QR code to access the document, leading to a fake website where corporate credentials are requested. With the QR code laid out in text characters, many protective solutions would fail to identify any suspicious links.

“We have previously seen phishers try to avoid link scanning by hiding URLs in images. Now they are attempting to evade image-based scanning by returning to text – this time to render a QR code. Any instance where a QR code prompts someone to enter corporate credentials on a mobile device should raise immediate suspicion.

When the QR code is formed using textual ASCII art, it is almost certainly a phishing attempt or a lure to a malicious URL. This trick has only one purpose: bypassing security technologies,” commented Roman Dedenok, Anti-Spam Expert at Kaspersky.

To defend against this threat, Kaspersky recommends deploying a proven mail server security solution such as Kaspersky Security for Mail Server that provides secure corporate email exchange, countering spam, email-borne infections, all forms of phishing, business email compromise (BEC), QR code attacks, and other threats.