Industries Under Fire: The Rising Tide of Protocol Exploits

No industry is immune from the surge of non-web protocol attacks, but some are facing a disproportionate share of the threats. The ThreatLabz 2025 Protocol Attack Surface Report exposes how cybercriminals are developing highly targeted strategies to exploit the unique vulnerabilities and operational gaps within specific sectors.

Retail is one of the hardest industries hit, accounting for 62% of observed non-web protocol attacks. Reliance on sprawling supply chains and outdated infrastructure makes it a prime target, with attackers deploying DNS tunneling, brute force methods, and malware to steal customer data, deliver ransomware, and disrupt operations during critical business periods.

Meanwhile, technology firms experienced significant DNS-focused attacks (78.5%), as cybercriminals seek to infiltrate code repositories, compromise intellectual property, and disrupt cloud-based operations. DNS tunneling remains the favorite tool for covert data exfiltration and command-and-control operations in this sector.

The finance sector continues to be a high-value target. Attackers exploit DHCP misconfigurations and SMB protocols to launch data theft campaigns and spread ransomware. Tools like Cobalt Strike, a favorite among advanced threat actors, have been employed extensively to abuse protocols and increase attack efficiency.

These findings paint a clear picture: cybercriminals are abandoning generic attacks in favor of precision strikes. By tailoring their tactics to exploit unique vulnerabilities, attackers are maximizing their ability to cripple organizations and profit from chaos.

Read the full ThreatLabz 2025 Protocol Attack Surface Report for more detailed industry trends and security recommendations.