2025: Year in Review

     Executive Summary

• If we were to summarize 2025 in a single theme, it would be the year in which defenders must begin rethinking ransomware and the role of ransomware as well as Ransomware-as-a-Service model, how it functions within the ecosystem, and how it continues to shape threat actor behavior. This report highlights key observations that explain why this reassessment is necessary and how it should inform our strategy for combating ransomware and extortion.
  
  
• Data Leak Sites, 2025 Facts & Numbers: Data leak sites (DLS), historically used for double extortion, reached a record high in 2025. Based on the analysis of ransomware DLS, the following observations were identified:
  
  
  • The number of claims in 2025 (7,819) increased by approximately 49.7% compared to 2024 (5,223). This continues the upward trend observed in prior years, with claims in 2024 (5,223) rising by about 13.3% over 2023 (4,611).
  
  
  • In 2025, the United States accounted for nearly 50% of ransomware claims, with 3,936 out of 7,819 claims observed. The top 10 countries by the number of claims also include Canada, Germany, the United Kingdom, Italy, France, Spain, Brazil, Australia, and India.
    
    This represents a recurring trend, as the United States has consistently led in the number of claims in previous years. In 2024, the U.S. accounted for 51% of total claims (2,675 out of5,223); in 2023, it accounted for 41% (2,168 out of4,611).
    
    
  • Top 20 groups responsible for nearly 70% of total claims in 2025 are Qilin (15%), Akira (10%), CLOP (6%), PLAY (5%), SAFEPAY (5%), INC RANSOM (5%), Lynx (3%), RansomHub (3%), DragonForce (3%), Sinobi (2%), Medusa (2%), Kill Security (2%), World Leaks (1%), Devman (1%), NightSpire (1%), Rhysida (1%), LockBit 5.0 (1%), Fog (1%) and Everest (1%).
    
    
• Data-Exfiltration-Only Attacks Continue to Grow. By 2025, encryption is no longer a part of an attack or even a primary component of many ransomware incidents. Many threat actors have moved away from traditional encryption-based ransomware toward extortion-centric models that prioritize data exfiltration and the threat of public disclosure, with encryption used selectively or avoided entirely.
  
  This shift toward exfiltration-first extortion significantly reduces Time-to-Ransom (TTR) and reshapes the economics of ransomware operations. Beyond cost efficiency, avoiding encryption also lowers operational risk by reducing dwell time and minimizing behaviors that trigger detection.
  
  In addition, encryption is no longer required to generate leverage. The threat of public disclosure now exerts pressure through reputational damage, regulatory scrutiny, contractual liability, and litigation risk. Defenders must recognize that data theft is the attack itself, not a preparatory step. While backup and recovery capabilities remain important, they do not mitigate extortion driven by reputational harm, regulatory exposure, or personal intimidation of employees and customers.
  
  
• Ransomware/Extortion Becomes Personal. As ransomware/extortion threats continue to mature, threat actors are growing more confident in applying maximum pressure, and the personal impact of ransomware/extortion attacks has escalated significantly. While ransomware has always involved personal data, extortion has historically and primarily targeted organizations. Starting in 2024 and continuing in 2025, targeting of individuals has intensified and expanded.
  
  Threat actors now routinely target individuals by name, including employees, executives, customers, family members, and even security researchers, using intimidation and psychological pressure as core leverage. This marks a shift from organizational disruption to personal coercion, enabled by widespread data exposure and amplified through public leak sites and direct outreach.
  
  At the same time, insider recruitment and the abuse of trusted access, including contractors, negotiators, and third-party service providers, have emerged as one of the fastest-growing additional risk vectors. These threats often originate from within the organization, further complicating detection, attribution, and response.
  
  For defenders, this evolution demands a broader approach to ransomware preparedness. Organizations must plan not only for system and data recovery, but also for individual-level targeting, insider risk, and downstream personal harm. Effective mitigation now requires integrating technical controls with employee awareness, insider risk programs, and response strategies that address personal exposure, psychological pressure, and operational impact.
  
  
• Beyond the RaaS Myth: A Post-Conti Ecosystem of Closed Shops. RaaS is no longer the only engine of ransomware growth, and its role in the modern ransomware ecosystem must be reconsidered. The Conti era and the post-Conti landscape are shaped by closed-shop, fully integrated crews that manage their own access acquisition, tooling, negotiations, and data publication. RaaS persists, but it is not foundational to the current reality.
  
  The investigation into the BlackBasta leaked chats, exposed in 2025, reinforced this shift, confirming an operating model closely aligned with Conti’s. The leaked communications revealed a structured, internally managed criminal organization, rather than an affiliate-driven service. While RaaS certainly still exists, it appears to apply primarily to smaller or newly launched groups, or to lower-tier activity within the ecosystem.
  
  Broader support ecosystems that have formed over the years are one of the key reasons for the success of these closed-shop groups. When analyzing the Russian-speaking cybercrime ecosystem, it is important to recognize its interconnectedness and interdependence. In our research on Yalishanda BPH and its cover-up by legitimate companies such as Media Land, we demonstrated close cooperation between bulletproof hosting providers and ransomware groups like BlackBasta, with BPH infrastructure serving as a backbone for threat actor operations.
  
  For defenders, this means that tracking ransomware brands or affiliate ecosystems alone is no longer sufficient. Effective defense now requires focusing on persistent operators, shared infrastructure, access brokers, financial flows, and tooling reuse across successor groups. Disrupting ransomware at scale increasingly depends on identifying and targeting the people and operational pipelines behind the brands.
  
  
• State Alignment and Geopolitical Hybridization of Cybercrime Continues to Grow. Ongoing militia conflicts continue to shape the threat landscape, accelerating the convergence of politically motivated cyber activity and financially driven cybercrime.
  
  “Independent” hacktivist collectives, such as the Russian Cyber Army, continue to target critical infrastructure and public-sector systems through opportunistic access points, while framing their activity as a civic duty or a wartime contribution. This environment lowers the barrier for state-aligned cyber activity to manifest through loosely organized actors, resulting in not only technical disruption but also psychological pressure and information control.
  
  In some cases, ransomware/extortion also appears to be used deliberately as an outsourcing mechanism, rather than as a core operating model, to provide cover, distance, or plausible deniability for specific operations. Groups such as Qilin demonstrate activity patterns consistent with both criminal monetization and geopolitical objectives. This dynamic is evident in our investigation of Qilin, where elements of the group’s behavior suggest the use of third-party capabilities within a broader, potentially state-aligned framework.
  
  For defenders, this means that hacktivist and ransomware activity must be assessed through both criminal and geopolitical lenses. Organizations should incorporate threat intelligence, geopolitical context, and cross-sector information sharing into detection and response and assume that some ransomware incidents may serve dual purposes beyond financial extortion.

Data Leak Sites, 2025 Facts & Numbers

This analysis draws on DLS data from 2025, supplemented by historical data from previous years for comparative insights. For consistency, we refer to the appearance of a victim’s name on a DLS as a “claim” rather than a “ransomware attack.” This distinction ensures more accurate ransomware attack statistics, particularly given cases of false claims by threat actors.

Analyzing data leak sites is complex, primarily because official confirmation from the entities involved is often lacking. In addition, it is important to remember that even when claims are verified, they represent only a fraction of ransomware incidents because many attacks go unreported.

Number of Claims Increased by Nearly 49.7% in 2025 Compared with 2024

• The number of claims in 2025 (7,819) increased by approximately 49.7% compared to 2024 (5,223).
  
• This continues the upward trend observed in prior years, with claims in 2024 (5,223) rising by about 13.3% over 2023 (4,611).

The United States is the Most Affected Country, Leading by 50%

• In 2025, the United States accounted for nearly 50% of ransomware claims, with 3,936 out of 7,819 claims observed. The top 10 countries by the number of claims are Canada, Germany, the United Kingdom, Italy, France, Spain, Brazil, Australia, and India.
  
• This represents a recurring trend, as the United States has consistently led in the number of claims in previous years. In 2024, the U.S. accounted for 51% of total claims (2,675 out of 5,223); in 2023, it accounted for 41% (2,168 out of 4,611).

Top 20 Groups Account for Nearly 70% of Total Claims.

• Top 20 groups responsible for nearly 70% of total claims in 2024 are Qilin (15%), Akira (10%), CLOP (6%), PLAY (5%), SAFEPAY (5%), INC RANSOM (5%), Lynx (3%), RansomHub (3%), DragonForce (3%), Sinobi (2%), Medusa (2%), Kill Security (2%), World Leaks (1%), Devman (1%), NightSpire (1%), Rhysida (1%), LockBit 5.0 (1%), Fog (1%), Everest (1%)
  
  
• Among the groups driving most ransomware claims, only a small subset are truly new players emerging in 2025. These include WorldLeaks, which appeared in early 2025 following a strategic pivot away from traditional ransomware toward extortion-only operations, as well as Sinobi, Kill Security, Devman, and NightSpire, all of which surfaced in late 2024 and became operationally visible at scale in 2025.
  
  
• By contrast, the majority of high-volume actors in 2024 and 2025 were not new but rather established or previously active groups that have persisted, rebranded, or evolved their operating models over time. Groups such as Cl0p, Qilin, Akira, PLAY, Medusa, Rhysida, Everest, and LockBit have been active since at least 2021–2023 and continue to dominate due to their scale, experience, and mature infrastructure. Others, including SAFEPAY, INC RANSOM, Lynx, DragonForce, Fog, and RansomHub, emerged before 2025 and rapidly matured through 2024, becoming prominent for operational efficiency rather than long-term presence.

Data-Exfiltration-Only Attacks Continue to Grow

Threat classification and nature of ransomware attacks have become increasingly complex due to a notable shift in adversary behavior beginning in 2024 and continuing into 2025. By 2025, encryption is no longer part of an attack or even a primary component of many ransomware incidents.

Ransomware originally followed a straightforward model: systems were encrypted, operations were disrupted, and victims were forced to pay for decryption. Over time, this model expanded to include data theft, giving rise to double extortion, in which attackers threaten to leak stolen data unless payment is made. This evolution led to the widespread use of data leak sites, where actors publicly name victims and release sensitive data to increase pressure.

In some cases, actors further escalated to triple extortion, applying additional pressure beyond the primary victim organization. This may include directly contacting customers, employees, or partners; threatening regulatory exposure; or launching secondary attacks, such as DDoS campaigns, to heighten coercion and urgency.

Many threat actors have evolved away from traditional encryption-based ransomware toward extortion-centric models that prioritize data exfiltration and the threat of public disclosure, with encryption used selectively or avoided entirely. According to a mid-2025 Sophos report, data encryption was used in only 50% of attacks, the lowest rate observed over the six years of the study. This continues the trend observed in 2024, when encryption declined from 70% to 50% by 2025.

Actors, whether well-established groups such as Cl0p, which ranked third in 2025 by number of claims, or newer groups that emerged in 2024–2025, for example, Kairos or Coinbase Cartel, are increasingly favoring data exfiltration and the threat of public disclosure. Let’s take a look at both of these new groups.

Kairos TA Profile & Extortion Tactics

• Kairos emerged in approximately July 2024 with a dedicated data-leak site and continued operating into 2025 as a low-profile but persistent extortion group. Between November 2024 and January 2026, the group claimed 59 victims on its data leak site (DLS).
  
  
• Kairos’ positioning on its DLS clearly outlines how the group applies pressure and structures its operations. The group’s extortion model is built around time-bound escalation and the deliberate isolation of victims. Initial demands are framed around payment in exchange for the deletion of stolen data and the prevention of public exposure. Victims are typically given a short negotiation window, after which the group escalates pressure by publicly disclosing the breach.
  
  
• One component of Kairos’ strategy is discouraging outside involvement. The group consistently warns victims against contacting law enforcement, incident response firms, or recovery companies, framing external engagement as a trigger for increased exposure, legal consequences, and reputational harm. This messaging is designed to force victims into direct, private negotiations, limiting their access to external support and increasing psychological pressure.
  
  
• If negotiations fail, Kairos escalates beyond simple publication. The group explicitly threatens to notify customers, partners, and competitors, and then to release the stolen data. This escalation model is intended to maximize downstream consequences, including regulatory scrutiny, contract termination, reputational damage, financial loss, and long-term business impact. The emphasis is not on operational disruption, but on sustained reputational and legal harm.
  
  
• In addition to victim listings, Kairos maintains a separate section of tracking media coverage and public reporting related to its activity. This indicates an awareness of and reliance on external visibility as a negotiation lever. By highlighting press attention, the group reinforces the credibility of its threats and signals to victims that non-payment will result in public scrutiny.
  
  
• Overall, Kairos fits within the growing class of actors that rely on data exfiltration and the threat of public disclosure as their primary coercive mechanisms, rather than system encryption, reinforcing the broader trend toward exfiltration-only extortion.

Coinbase Cartel Profile & Extortion Tactics

• Coinbase Cartel appeared around September 2025, presenting itself explicitly as a data–exfiltration–only extortion group and deliberately distancing its operations from traditional ransomware.
  
  
• Based on its public statements, the group openly rejects the “ransomware” label, framing its activity as data acquisition and information exposure rather than system disruption or encryption. It claims to obtain data through what it describes as “authorized access” and partnerships, language that strongly suggests reliance on affiliates, compromised credentials, or the abuse of trusted access.
  
  
• Pressure is applied through controlled disclosure, not immediate public leaks. Coinbase Cartel outlines a structured escalation path in which non-engagement or refusal to negotiate results in staged data releases, beginning with limited leak channels and escalating to broader public exposure.
  
  
• The group’s pressure model follows a defined sequence. It begins with a private verification phase, during which victims are provided with proof of compromise through limited samples or private data packages. This establishes credibility while keeping the breach initially contained.
  
  
• If negotiations fail, the group transitions to a controlled-leak phase, releasing partial datasets to increase pressure. On its data leak site, Coinbase Cartel assigns different victim statuses, such as “Active,” “Leaking,” and “Leaked”, signaling progression through the escalation process. In some cases, the group supplements these listings with public-facing messages, for example: “We have 2TB of your files. Proof in chat. Contact us by Monday.” These announcements are designed to amplify urgency while maintaining control over the pace of disclosure.
  
  
• This staged approach allows Coinbase Cartel to maintain prolonged leverage while managing reputational damage incrementally, rather than triggering a single, disruptive disclosure event. Taken together, Coinbase Cartel exemplifies a mature extortion-only operating model, in which leverage is derived from stolen data, reputational exposure, and regulatory risk, aligning closely with the broader shift toward data-centric coercion observed among newer entrants in 2024–2025.

The Operational and Strategic Implications of Exfiltration-Only Attacks

The shift toward exfiltration-only extortion represents a fundamental change in how ransomware operates and how harm is inflicted. By deprioritizing encryption, threat actors shorten Time-to-Ransom (TTR) and rely increasingly on data extortion rather than system disruption. This shift toward data exfiltration–only operations also signals an effort to avoid operational risk, reflecting attackers’ adaptation to defensive improvements such as backups, recovery capabilities, and immutable storage.

In doing so, actors have reshaped the economics of ransomware into a model in which speed, access, and control over information matter more than technical disruption. This evolution exposes the limits of legacy defensive assumptions. Organizations that focus primarily on resilience against encryption, restoring systems, rebuilding environments, and resuming operations may still fail to contain the true impact of an incident. When leverage is derived from data exposure, reputational damage, regulatory scrutiny, and personal intimidation, recovery does not end the crisis; in many cases, it marks the beginning of prolonged legal, financial, and organizational consequences.

As a result, defenders must shift from a disruption-centric mindset to one centered on data protection, access governance, and early detection of exfiltration activity. Treating data theft as a secondary phase or merely a precursor to “real” ransomware activity leaves organizations responding after coercive leverage has already been established.

Ultimately, these trends challenge the continued use of the term “ransomware attack” as the dominant framing for modern incidents. In a growing number of cases observed in 2025, there is no meaningful encryption event and no attempt to deny system availability.

What remains is corporate coercion via data theft executed with precision and sustained pressure. Recognizing this shift is not merely semantic; it is foundational to how risk is assessed, how incidents are detected and mitigated, how insurance and compliance are structured, and how effective defensive strategies are designed going forward.

Ransomware/Extortion Becomes Personal: Individual Targeting & Insider Alignment with Threat Actors

When we think about ransomware and extortion attacks, one of the most evident shifts in 2024–2025 is how much more personal they have become. Our observations are centered around three components: (1) actors increasingly apply pressure directly to individuals connected to the victim organization, (2) security researchers are increasingly being treated as targets through intimidation, threats, and narrative manipulation, and (3) insider alignment and misuse of trusted access is becoming a more common enabling factor.

First, we see an escalation in pressure on individuals connected to targeted organizations, especially customers whose personal data is stolen during intrusions. Ransomware has always been personal in nature because it involves the theft and exposure of sensitive information, but in 2025, this has shifted further: customer data is no longer just a byproduct of compromise; it is used as a direct extortion tool.

By threatening to leak or actively publishing customer records, attackers turn the victim’s customers into secondary targets, increasing emotional pressure, reputational fallout, and legal exposure for the organization. Individuals associated with targeted organizations and their personal data are not collateral damage; they are the target itself.

Kido International incident

In September 2025, the group Radiant publicly claimed responsibility for the attack on Kido International, a chain of early-years nurseries operating in London and internationally. Kido appears to have been the first victim claimed by Radiant and subsequently claimed six additional victims.

According to the actor’s claims, Radiant gained access to personal data for approximately 8,000 children and staff members, including names, dates of birth, home addresses, and parent contact information. What made this incident particularly severe was the way the group applied pressure: Radiant posted photographs of children, along with identifying details such as their names and ages, directly on its data leak site.

Among the many observed incidents, this was one of the most disturbing. While leaking personal data is a common part of extortion activity, the exposure of small children in this manner is not something we see often, and it highlights how far some actors are willing to escalate pressure to maximize psychological impact.

Radiant’s activity reportedly ended in October 2025, correlating with law enforcement action in the United Kingdom. On October 7, 2025, the UK Metropolitan Police announced the arrest of two 17-year-old males in connection with the incident. Public reporting did not identify their nationalities, and police statements likewise did not disclose nationality or citizenship information when confirming the arrests.

Second, and equally concerning, we are seeing an increase in targeting of security researchers. Threat actors increasingly treat researchers as part of the battlefield, naming them directly, threatening retaliation, and using intimidation to discourage investigation and reporting. This marks a clear shift from organizational extortion toward individual intimidation and psychological coercion, where the goal is not only to pressure victims into payment, but also to shape the information environment and reduce the risk of exposure for the actors themselves.

Communication between threat actors and researchers has long existed. However, threat actor engagement and its nature have shifted significantly over the years.  Ransomware actors and data extortion groups historically operated in closed, underground ecosystems communicating through Dark Web forums, private Jabber channels, and invitation-only communities. Over time, however, the center of gravity moved outward. Threat actors increasingly use public-facing platforms such as Telegram and X (formerly Twitter) not only for announcements but also for reputation-building, intimidation, and direct engagement with the security community.

In our research, we outlined how modern actors are no longer content to stay hidden. What started with actors putting researchers’ images on their profiles as a “joke” and mentioning their work on Dark Web forums has moved beyond the underground, escalating into more direct and intensified threats.

Many actors now actively seek attention and influence, using visibility as a form of operational advantage. Telegram and X have become negotiation tools, propaganda outlets, and status symbols. In this environment, the goal is not only to extort victims but also to control the narrative around breaches, disrupt investigations, and intimidate those who publicly track and expose their operations. This is where security researchers, who are on the front line of combating these actors, increasingly become targets themselves.

Scattered Lapsu$ Hunters: Chaos-as-a-Service

Hybrid groups like Scattered LAPSUS$ Hunters have been observed publicly boasting on Telegram and engaging in online trolling and taunting. On August 9, 2025, a Telegram group calling itself Scattered Lapsu$ Hunters – The Com HQ SCATTERED SP1D3R HUNTERS appeared. According to the actors themselves, their “powerful” collaboration involved Lapsu$, ShinyHunters (linked to BreachForums), and Scattered Spider.

Calling themselves Chaos-as-a-Service, they created exactly that — chaos. Over the course of a couple of months, they moved across different Telegram channels and chats. Across all of them, the chatter dripped with hate: against companies they claimed to have breached, against law enforcement (including the publication of allegedly stolen documents), and even against individuals such as associated employees and security researchers (with audio messages included).

One instance included actors posting a message offering a reward and encouraging individuals to call the FBI to impersonate a relative of a security researcher, using a staged claim that the researcher was involved in criminal activity. The actors offered $1,000 for the “prank.”

The membership behind these Telegram channels and groups is reportedly made up mostly of English-speaking youth and is often attributed to the so-called “Com.” What stands out in the actors’ communication is their frequent references to famous Russian hackers, their desire (or pretense) to emulate them, and their use of Russian. The “Russian hacker” phenomenon, and ransomware in particular, has become an intriguing social trend. While Russian actors still dominate the scene, more “aftercomers” are arriving. In Scattered Spider’s case, reading between the lines reveals very young individuals heavily influenced by that legend and trying to imitate it.

That may help explain the emergence of collaboration between Scattered Spider collective and Russian actors such as ALPHV/BlackCat, DragonForce, and Qilin. However, it is a surprising development to see an open partnership involving Russian-speaking ransomware groups, which have historically operated as closed communities with strict trust barriers and controlled recruitment. While collaborations with English-speaking actors do exist, they have evidently become more common over the past three years. We attribute this shift to the current geopolitical landscape and the growing likelihood of sabotage operations conducted through proxy actors. We explore the implications of this model further in the “State Alignment and Geopolitical Hybridization of Cybercrime Continues to Grow” section, where we examine how proxy-style disruption and plausible deniability may shape modern ransomware operations.

This shift in targeting researchers expands cyberattacks from a primarily organizational risk to a threat model that increasingly includes direct pressure on individuals. Targeting researchers and employees serves a strategic purpose: it enables intimidation, disrupts attribution and reporting, and attempts to shape the information environment in ways that protect threat-actor operations. For defenders, this reinforces the need to treat cyberattack response as both a technical and human-security challenge, requiring planning that accounts for personnel risk, coordinated communications, and the broader psychological and reputational dimensions of extortion.

Lastly, we are dealing with a growing insider threat, with more incidents and reports pointing to insider collaboration, recruitment, or the misuse of trusted access. This includes employees who intentionally assist threat actors, as well as individuals who may be coerced into cooperation.

In 2025, this risk extended beyond traditional insider scenarios and into the security industry itself. Two U.S. cybersecurity professionals, one previously working as a ransomware negotiator and the other as an incident response manager, pleaded guilty to conspiring to conduct ransomware attacks using ALPHV/BlackCat, targeting multiple organizations and extorting millions in cryptocurrency.

Their roles demonstrate the insider threat in its most dangerous form: trusted security professionals misusing their access, expertise, and operational knowledge to support a ransomware campaign. While the victims were organizations, the implications are broader. This case highlights how insider alignment can blur the lines between defense and offense, and how ransomware actors can benefit from capabilities originating within the defender ecosystem.

At the same time, we continue to see reports of remote IT workers being hired under stolen or fabricated identities, a tactic prominently associated with DPRK-linked operations that blurs the line between external compromise and insider access. This model is particularly dangerous because the attacker does not need to breach technical controls if they can obtain access through a trusted role within the organization. Researchers and law enforcement have uncovered elaborate fraud schemes in which North Korean operatives used stolen or fake identities to secure remote IT positions at U.S. and global companies. These schemes rely on convincing false personas, including fabricated employment histories, professional references, and counterfeit identification, allowing threat actors to gain legitimate access to internal systems through the hiring process itself.

In June 2025, the U.S. Department of Justice and FBI announced coordinated criminal actions against a long-running network involving facilitators in the United States and Ukraine in which North Korean operatives posed as remote IT workers at more than 100 U.S. companies, using stolen identities tied to over 80 U.S. citizens. One individual was arrested (Zhenxing “Danny” Wang), and others were indicted for assisting the scheme, which caused at least $3 million in damages and involved theft of cryptocurrency and sensitive data, including ITAR-governed defense information. Authorities also seized laptops, financial accounts, and fraudulent domains used to support the operation.

In July–August 2025, an Arizona woman was sentenced to over eight years in federal prison for operating a “laptop farm” that facilitated North Korean operatives posing as remote IT workers at more than 300 U.S. companies. She managed around 90 laptops used by North Korean workers under stolen identities, and the broader scheme generated more than $17 million for the North Korean regime. Companies across multiple sectors, including manufacturing, aerospace, technology, and media, were affected. Chapman pleaded guilty to wire fraud, identity theft, and money laundering. This case underscores how domestic facilitators can enable remote insider access at scale and highlights how deep and operationalized the identity-based threat has become.

The FBI’s IC3 issued public service advisories in 2025, warning that North Korean remote worker operations continue to serve as a sanctions-evasion and data-theft vector, urging organizations to strengthen identity verification and vetting processes. This threat is not theoretical. Security teams at major technology firms have publicly confirmed they have detected and blocked thousands of suspected North Korean remote worker applications, and they continue to observe increases over time. These remote workers can gain access to internal tools such as GitHub repositories, Slack channels, cloud infrastructure, and privileged systems, enabling them to exfiltrate sensitive data, embed backdoors, or facilitate broader cyber operations from within.

Taken together, this shifts ransomware and extortion risk away from a purely external compromise model toward one where the most damaging access can come from inside the organization or through contractors, third-party providers, and other trusted relationships. This insider trend creates unique detection challenges because it bypasses traditional perimeter-focused defenses entirely. To mitigate this evolving threat, organizations must expand their defensive posture beyond technical controls. That includes stronger identity verification, tighter access governance, insider-risk awareness, and behavioral monitoring while also recognizing that collateral damage in the form of targeted employees, executives, and customers is now a realistic and expected outcome of modern ransomware incidents.

Beyond the RaaS Myth: A Post-Conti Ecosystem of Closed Shops

The longstanding belief that Ransomware-as-a-Service models are the primary driver of ransomware growth is no longer compatible with observable actor behavior. While the RaaS model is still present, it is largely absent among the top-performing groups driving the most activity.

The collapse of Conti in 2022, following the leak of internal chats, did not eliminate its operators, capabilities, or organizational structure; it merely distributed them. The leaks gave us unprecedented visibility into how Conti actually functioned, revealing a structured internal hierarchy of established members, specialized roles, and coordinated workflows rather than the chaotic, affiliate-driven RaaS ecosystem many believed they represented.

This organizational model did not disappear with Conti’s brand. It persisted and reappeared inside BlackBasta, one of Conti’s successors. The 2025 BlackBasta leak, which we uncovered and analyzed in detail, confirmed what the Conti leaks showed two years earlier: these groups are not affiliate-driven ransomware collectives. They are fully structured cybercrime enterprises, with defined roles, management oversight, internal KPIs, and operational discipline.

One reason these groups initially stepped away from RaaS was their reliance on botnets for initial access. As we’ve seen in the cases of Conti and BlackBasta, both groups heavily relied on botnets for initial access, specifically TrickBot for Conti and QakBot for BlackBasta. Their reliance on botnet infrastructure helped provide scale and consistency in the early stages of compromise, reducing dependence on third-party affiliate access and enabling more internally coordinated execution. Even when these botnets are disrupted by law enforcement, the groups adapt, pivoting to other loaders or rebuilding their access pipelines. This dynamic is likely to continue, reinforcing the idea that modern ransomware enterprises use botnets as core infrastructure, not auxiliary tools.

Another leading group in 2025, Akira, which has been operating since approximately April 2023, is also highly likely to be the successor to Conti operators and their organizational culture. External reporting supports this assessment: analysts from multiple vendors have noted overlaps in intrusion workflows, negotiation styles, encryption methods, and operator identifiers, consistent with the broader Conti diaspora.

These connections were also confirmed through blockchain investigation. By tracing cryptocurrency transactions, Arctic Wolf Labs researchers identified direct financial interactions between Conti-affiliated operators and wallets connected to Akira. This represents one of the strongest available linkages, grounding attribution in blockchain forensics.

While no internal leaks of Akira’s operations have become publicly available, unlike the extensive chat leaks that exposed the internal mechanics of Conti in 2022 and BlackBasta in 2025, the group’s longevity, stability, and consistently high operational performance strongly suggest that Akira operates under the same organizational model as Conti and BlackBasta.

Akira’s financial performance also aligns with the operational continuity expected from a Conti-lineage group. According to the recent FinCEN report, which analyzed ransomware payments from 4,194 ransomware incidents from January 1, 2022, to December 31, 2024, Akira was identified among the top 10 groups. FinCEN identified 1,969 BSA filings tied to the top 10 most frequently observed ransomware variants. Among them, Akira accounted for 376 reports, totaling $120.9 million in extortions from April 2023 to December 2024. This places Akira fourth, behind BlackBasta (~$137.7 million), LockBit (~$252.4 million), and ALPHV/BlackCat (~$395.3 million).

The evidence from Conti and BlackBasta shows that the most impactful ransomware groups are not simply RaaS operations but structured, internally managed criminal organizations. Their resilience is rooted primarily in the human component, primarily experienced operators who have been in this ecosystem for years and continue to resurface across successor brands. Cases such as Oleg Nefedov, who was recently added to a wanted list for his alleged involvement in the Conti and BlackBasta operations and is discussed in our research, highlight how individual actors persist even when group names disappear.

Additional findings in 2025 reinforced that ransomware is not driven solely by the groups executing intrusions and negotiations; it also relies on a broader support ecosystem, including services such as bulletproof hosting (BPH). One of the clearest examples was the relationship between Yalishanda BPH and BlackBasta. Our research showed that Oleg Nefedov, now an officially wanted individual tied to Conti and BlackBasta activity, maintained close operational ties within this infrastructure layer, enabling both the hosting provider and the ransomware group to scale and persist. This was not incidental “service usage,” but an ecosystem relationship that helped sustain long-term operations.

What made the case even more significant was how Yalishanda’s infrastructure was obscured behind legitimate-looking companies such as Media Land. This kind of cover structure adds complexity for defenders, because it blurs the line between criminal infrastructure and commercial services. At the same time, it creates clear opportunities for enforcement action. In this case, Media Land and related entities were later sanctioned, along with associated individuals,  including Aleksandr Volosovik and Kirill Zatolokin.

Ultimately, this reinforces the broader point: ransomware is not a single business model or a single group problem — it is an interconnected ecosystem formed over the years. The 2025 landscape also shows that defenders can no longer rely on a RaaS-centric view of ransomware as the default model. While RaaS still exists, the most impactful activity is increasingly driven by closed-shop, internally managed crews that control access acquisition, tooling, negotiations, and leak-site operations. This requires a shift away from threat models built around “affiliate ecosystems” and toward a more realistic understanding of ransomware as an interconnected set of mature criminal enterprises. If defenders continue to treat ransomware growth as a function of affiliate recruitment alone, they risk missing the operational continuity that allows these groups to survive disruption and scale quickly across targets.

This means the ecosystem does not reset when a brand collapses. Instead, operators rebuild, carrying forward the same tactics, organizational norms, toolchains, and capabilities. Understanding this continuity is essential for defenders and policymakers because it explains why ransomware remains stable and scalable despite repeated takedowns, leaks, and public disruption of specific “brands.”

At the same time, this human factor that gives these groups an advantage can also be used against them. Countering modern ransomware requires targeting the people, infrastructure, and financial pathways behind these operations through legal actions, including sanctions, arrests, public attribution, and coordinated international pressure. We have already seen effective models for this approach. Operation Endgame and Operation Cronos demonstrated how international law enforcement can work together to expose, pursue, and dismantle the operators and networks enabling major malware ecosystems, rather than treating ransomware as a purely technical problem. Their success reinforces a key lesson: meaningful disruption comes from going after the individuals and systems that sustain these operations, not just the malware they deploy.

State Alignment and Geopolitical Hybridization of Cybercrime Continues to Grow

Across multiple investigations, our research shows that the separation between financially motivated ransomware groups and politically motivated cyber activity is becoming increasingly blurred. This is not a theoretical trend; it comes directly from patterns documented in our work on Russia’s militarized cyber ecosystem, the operational behavior of hacktivist groups, and our profiling of Qilin. Together, these cases highlight how the modern threat landscape is shifting toward hybrid models where criminal extortion, influence operations, and geopolitical objectives increasingly overlap.

What makes this shift particularly important is that the actors involved do not need to be formally state-directed to function in a state-aligned way. Many operate inside environments shaped by wartime narratives, safe-haven conditions, and propaganda-driven social pressure, where attacking certain targets becomes socially normalized and ideologically rewarded. In these conditions, ransomware and extortion groups can act as force multipliers applying pressure, causing disruption, and generating chaos in ways that align with broader strategic interests, even when financial gain remains a core driver.

Russia’s Militarized Cyber Ecosystem & Hacktivism

Our research into the militarization of Russian cybercrime reveals that state-driven narratives, propaganda framing, and an ongoing blending of patriotic identity with online activity deeply shape the digital environment in Russia. Russia’s broader information landscape, shaped by decades of state messaging, wartime rhetoric, and civic militarization, effectively normalizes participation in cyber operations and creates fertile ground for hybrid alignment between criminal actors and geopolitical objectives.

The trend did not emerge overnight. The militarization of Russia’s civic life, shaped by legal, cultural, and institutional shifts, laid the groundwork for “digital soldiers”: volunteer cyber actors, most notably ONF’s CyberSquad, an official state-approved group, and hacktivist groups such as Cyber Army of Russia, both of which were subjects of our research.

While their operations differ in nature, their activity is driven by language and symbols that echo official messaging and appeal to duty or revenge. Their activity serves on the broader agenda of controlling the information space, effectively reinforcing the state’s efforts to regulate speech and shape the public narrative. In addition, it reflects the state’s attempt to enlist citizens into a form of digital conscription, transforming online participation into an act of civic duty.

This convergence is visible not only in individual rhetorics and hacktivist behaviors but also in how pro-Russia hacktivist groups have evolved to target critical infrastructure sectors. According to a joint advisory from CISA, FBI, NSA, and international partners, pro-Russia hacktivist groups such as Cyber Army of Russia Reborn (CARR), Z-Pentest, NoName057(16), Sector16, and affiliated actors are conducting opportunistic attacks against U.S. and global critical infrastructure entities, including water and wastewater systems, food and agriculture, and energy sectors.

The advisory also underscores that these hacktivists, while less technically sophisticated than advanced persistent threat (APT) groups, employ tactics such as:

• Exploitation of poorly secured VNC and remote access services to gain access to operational technology and critical control systems.
• Reconnaissance and scanning for internet-exposed services and vulnerable remote endpoints as an initial access vector.
• Industrial control system (ICS) intrusion attempts can lead to physical impacts on infrastructure operations.
• Use of “hack and leak” and defacement activity to amplify messaging and support pro-Russia narratives.

Ransomware Hybrid with Nation-State & Activist-Style Messaging

Ransomware actors have also become one of the clearest examples of how modern cybercrime is hybridizing into something that sits between profit and politics. The Qilin threat actor is a strong case study of this shift. Qilin, originally known as Agenda, has been active since mid-2022, presenting itself as a Ransomware-as-a-Service (RaaS) operation. By 2025, it had emerged as one of the most prolific groups globally, claiming hundreds of victims across multiple regions and sectors.

Unlike ransomware crews that operate with strict criminal anonymity, Qilin’s communications show a consistent political and ideological layer. Its leak-site rhetoric and broader messaging increasingly resemble hacktivist-style framing, where attacks are not presented as purely transactional extortion but as part of a wider narrative. The group openly signals Russian identity, leverages branding to attract Russian-speaking participants, and embeds cultural references and recruitment language that appeal to nationalist sentiment. At the same time, Qilin also appears willing to expand beyond its traditional base by welcoming English-speaking affiliates, suggesting an intent to scale rather than remain a closed local operation.

Qilin publicly outlines targeting “rules,” including claims that it avoids CIS and BRICS countries, a familiar convention in the Russian-speaking ecosystem. Yet, it notably violated this position when it attacked the Ukrainian Ministry of Foreign Affairs in March 2025. That decision is difficult to justify on financial grounds alone. It aligns more naturally with the wartime geopolitical environment in which Russian-speaking actors operate, where anti-Ukrainian targeting has become normalized across multiple layers of the ecosystem.

While it remains unclear whether Qilin is formally linked to any state intelligence apparatus, its behavior consistently reflects a political dimension beyond monetization. In practice, Qilin represents the type of actor increasingly observed in 2025: a financially motivated ransomware operation operating inside a state-shaped environment, adopting activist-style narratives, and blurring the line between cybercrime and geopolitical conflict.

This same hybridization is also visible and correlates with another leading group, DragonForce, which exhibits similar behavioral characteristics and collaboration patterns that would have been less likely in earlier ransomware eras. Like Qilin, this group originates from the Russian-language cybercrime environment and shows patterns consistent with alignment with Russia. One of the strongest indicators remains targeting behavior: what started as a “do not hit CIS” rule has expanded into avoid-lists that increasingly include BRICS-aligned or otherwise “friendly” states. This reflects an ecosystem operating within geopolitical boundaries, not just criminal preference.

At the same time, DragonForce’s posture is unusually outward-facing. The group uses English more openly than is typical for Russian ransomware operators and promotes coalition-style language, encouraging coordination and “equal terms” under a shared framework.

Qilin’s approach is different but equally telling: it invests heavily in Russian-speaking community-building and forum influence, while also signaling scale and legitimacy through messaging that resembles structured recruitment, including promotion of “pentester” jobs tied to a physical office environment in Moscow. Both models point to ecosystem-building rather than short-term extortion alone.

This trend becomes even more visible when examining collaboration patterns involving Scattered Spider, as mentioned earlier in the report. While DragonForce and Qilin originate from the Russian-speaking ransomware ecosystem, Scattered Spider is largely comprised of English-speaking actors. One high-profile case illustrates this overlap. In April 2025, Marks & Spencer was hit by a major ransomware incident attributed to Scattered Spider, with reporting indicating that the group ultimately deployed the DragonForce ransomware strain.

This matters because it challenges one of the most stable assumptions about the Russian-speaking ransomware ecosystem: that its core actors remain closed and highly selective, despite years of infiltration attempts, arrests, and law enforcement disruption. That assumption still largely holds, which is exactly why DragonForce and Qilin stand out. Their unusually open posture toward English-speaking actors and loose collectives like Scattered Spider should not be treated as normal affiliate recruitment. It should be treated as a signal that collaboration is becoming strategic.

DragonForce and Qilin have both shown a deliberate willingness to broaden participation beyond the traditional Russian-only trust model. This openness is not typical of mature Russian-speaking groups that historically relied on language filtering and controlled recruitment as protective measures. Yet in 2025, we see messaging that invites external cooperation, coalition-style framing, and recruitment narratives designed to pull in actors outside the core ecosystem.

The most concerning explanation is also the most logical: this openness enables sabotage by proxy — operations executed “through someone else’s hands.” Recruiting English-speaking collectives such as Scattered Spider allows Russia-aligned ransomware groups to benefit from disruption, access, and chaos while shifting visibility and blame outward.

Scattered Spider and similar actors bring high-tempo intrusion capability and unpredictable public-facing noise. In return, groups like DragonForce and Qilin provide mature extortion infrastructure, including negotiation leverage, leak-site machinery, and monetization capacity, while maintaining distance from the initial intrusion behavior that attracts the most attention.

In other words, this openness is not a sign of trust. It is a sign of utility. It allows Russian-speaking ransomware groups to outsource the messiest part of the operation while positioning themselves as the professional extortion layer. This model fits the broader pattern seen across hybrid influence and hacktivist activity: not every actor needs to be state-directed for state-aligned outcomes to emerge. In a militarized environment, the ecosystem itself becomes a mechanism for proxy disruption, deniability, and the cultivation of operational reach through external actors.

Prepare for Hybrid Criminal–State Activity

For defenders, this hybridization requires a shift in mindset and prioritization. Organizations, especially those in critical infrastructure and government-adjacent sectors, must assume that politically motivated disruption can come from actors ranging from state-linked operators to loosely organized hacktivist collectives using simple but effective access paths.

This also matters for ransomware and extortion. These groups increasingly operate within the same ecosystem and can serve as cover, pressure tools, or opportunistic follow-on actors when geopolitical tensions rise.

At the same time, defenders should treat ideological activity as an early warning signal, not noise. Hacktivist chatter, propaganda-style messaging, and opportunistic intrusions often indicate broader geopolitical intent and can precede more damaging campaigns, including data theft and extortion.

The blurred line between criminal and geopolitical operations means that even low-complexity intrusions can have high-impact outcomes when aimed at symbolic or strategic targets, and defense strategies must reflect that reality through stronger visibility, faster detection, and incident response planning that accounts for both technical disruption and political escalation.

Conclusion: Think Outside of the Adopted Ransomware Beliefs Box

If there is one lesson 2025 makes impossible to ignore, it is this: defenders and researchers can no longer afford to treat ransomware as a static problem. Ransomware is changing – structurally, economically, and politically and any defensive model that does not continuously reassess how it actually operates will fall behind. The RaaS model, hybrid criminal–geopolitical operations, and exfiltration-only extortion are not edge cases; they are reshaping what ransomware is and how harm is inflicted.

In an exfiltration-first world, ransomware defense cannot be built around restoring systems alone; it must be built around preventing the use of leverage. The attacker’s win condition is no longer encryption. It is the control of sensitive data and the ability to weaponize it. Increasingly, that leverage is not limited to corporate documents or internal files. Customer records, employee information, and other personal data have become the most valuable pressure point. In this model, personal data is not collateral damage; it is the target itself. The true impact comes from what follows exposure: reputational collapse, regulatory scrutiny, contractual fallout, and long-term legal and financial consequences that persist long after systems are restored.

This shift also forces a fundamental rethink of threat modeling. A RaaS-centric lens pushes defenders to track brands, malware families, and affiliate programs, but 2025 shows that the most damaging actors operate as persistent enterprises that survive rebrands, leaks, and takedowns. The focus must move from names to people. Effective defense now depends on operator-centric detection and disruption: identifying repeatable intrusion workflows, access pipelines, credential abuse patterns, negotiation behaviors, and infrastructure dependencies. Continuity with the same playbooks, the same discipline, the same operational DNA matters more than the logo on a leak site. Rebranding should be treated as normal lifecycle behavior, not as a reset of risk.

Finally, ransomware can no longer be viewed as a purely criminal problem. The growing overlap between extortion activity and geopolitical disruption means some incidents are designed not just to generate profit, but to create instability, public pressure, or strategic impact. Hybrid operations shaped by wartime narratives, hacktivist-style messaging, and proxy collaboration blur traditional boundaries between crime and state influence. For defenders, this means ransomware incidents must be assessed through both criminal and geopolitical lenses. Mitigation now requires not only strong technical controls but also contextual threat intelligence, awareness of geopolitical dynamics, and preparedness for incidents that aim not only to influence trust, perception, and public confidence but also to extract payment.

Ransomware and extortion are no longer just a technical failure or a criminal intrusion. It is an evolving system of coercion – economic, personal, and political. Defending against it requires the same evolution in how we think, model risk, and act.

About Analyst1

Threat intelligence teams often struggle to bridge the gap from insight to action. Analyst1 is the Centralized Threat Intelligence Platform designed to resolve this issue. It automatically organizes threat data, links it to your assets and vulnerabilities, and customizes views for different roles. Analyst1’s orchestration layer streamlines workflows and automates reliable actions by integrating with SIEM, ticketing, and vulnerability management systems. From Fortune 500 financial institutions to national security agencies, enterprises trust Analyst1 to unify their defenses, significantly reducing their response time from days to minutes.