Attackers target public-facing applications over ransomware in 2025

In late 2025, attackers shifted their focus from high-volume ransomware campaigns to breaking into public-facing applications, according to analysis cited by Telecoms Tech News. Exploiting internet-exposed APIs and web services became the leading way into corporate systems.

The change reflects how digital transformation is erasing the boundary between internal networks and the public internet. As organisations roll out more revenue-generating online services, they unintentionally widen the attack surface. Security teams now have to treat every new external-facing application as a likely entry point, not a side project.