The Counter Risk Unit™ (CTU) analysis workforce analyzes safety threats to assist organizations shield their programs. Based mostly on observations in July and August, CTU™ researchers recognized the next noteworthy points and modifications within the world menace panorama:
- Ransomware stays a unstable menace regardless of disruptions
- Absent MFA permits exploitation of stolen credentials
- Legacy vulnerabilities keep their worth
Ransomware stays a unstable menace regardless of disruptions
Regulation enforcement actions have made an affect on the ransomware ecosystem however haven’t lowered the variety of assaults.
Ransomware continues to pose a significant menace to organizations. Despite the fact that the variety of victims posted to leak websites has declined since reaching an all-time peak in March 2025, the figures in July and August remained increased than in the identical months of 2024. Regardless of the quantity of media consideration dedicated to high-profile ransomware and knowledge extortion assaults by Scattered Spider and ShinyHunters, the 2 most prolific schemes throughout July and August had been Qilin and Akira. Each schemes have been extremely lively throughout 2025 (though the variety of victims posted every month is decrease than the month-to-month quantity from earlier prolific operations like LockBit). Even so, general, the excessive variety of ransomware assaults within the second and third quarters of 2025 have principally been extra evenly distributed throughout a number of teams in comparison with earlier years.
Regulation enforcement actions in opposition to main ransomware operators in 2024 and 2025 have prompted fragmentation and volatility within the ransomware panorama. Usually, every legislation enforcement disruption conjures up a brief spike in new group creations. Thirty-seven new schemes appeared within the first half of 2025. 4 others emerged in July, adopted by one other 4 in August. The sustained excessive quantity could also be linked to the common cadence of legislation enforcement exercise focusing on LockBit all through 2024. A number of teams that had been thought-about dormant returned to exercise throughout July and August 2025 too. In whole, 52 ransomware schemes had been lively in August, a month-to-month quantity that has solely been surpassed 3 times within the earlier two years.
The brand new schemes are probably not fashioned by new cybercriminals. As a substitute, associates who labored with disrupted operations could be part of or launch a brand new scheme, both pooling efforts with different displaced associates or working independently. New schemes may be rebrands of older operations. Associates could alternatively transfer to established operations corresponding to Akira that then improve their assault tempo because of having extra assets. These rebrands and circulation of associates throughout present or new teams could make kill chains arduous to determine and attribution harder.
Despite the fact that these developments can improve the general issue of monitoring the ransomware ecosystem, they don’t enormously change the important thing defenses in opposition to most ransomware assaults: immediate patching, particularly of internet-facing units; phishing-resistant multi-factor authentication (MFA); and complete monitoring of endpoints and networks. As well as, it’s changing into more and more vital to watch cloud and hybrid environments for malicious exercise as menace actors pivot to the cloud.
 |
What You Ought to Do Subsequent
Monitor authorities initiatives on advancing cloud safety. |
Absent MFA permits exploitation of stolen credentials
Implementing MFA prevents menace actors from benefiting from stolen credentials.
CTU researchers have noticed a number of incidents the place cybercriminals or state-sponsored menace actors obtained preliminary entry to their sufferer’s surroundings by abusing VPN credentials. For instance, the GOLD LEAPFROG menace group abused VPN credentials in an early 2025 assault that culminated within the deployment of SafePay ransomware.
Unauthorized entry of this nature permits menace actors to bypass conventional safety measures and acquire direct entry into inside programs, even when the equipment is totally patched in opposition to identified vulnerabilities. Different varieties of generally abused entry embrace distant desktop logins or administrative accounts. In different phrases, strategies designed to guard approved entry for distant workers may also give attackers entry if the safety shouldn’t be sufficiently sturdy.
Risk actors typically buy the credentials on underground marketplaces. Infostealer malware steals credentials and different knowledge from programs that it infects. The stolen knowledge is then packaged into logs and offered on-line to different menace actors. Hundreds of thousands of logs can be found on the market, and the quantity continues to rise sharply every year. In consequence, defending programs from infostealer infections types a key a part of defending in opposition to subsequent ransomware or knowledge extortion assaults.
Risk actors who receive partial credentials may attempt to brute-force entry on VPN accounts. In the event that they reach gaining entry, it’s nearly all the time as a result of the VPN doesn’t require MFA to authenticate. MFA alone doesn’t stop all unauthorized entry, however it does cut back the specter of probably the most opportunistic cybercrime. Implementing phishing-resistant MFA on all internet-facing companies and home equipment reduces danger ranges even additional. This kind of MFA makes use of hardware-backed strategies to stop token theft.
|
What You Ought to Do Subsequent
Assessment steerage revealed by U.S. Cybersecurity and Infrastructure Safety Company (CISA) on |
Legacy vulnerabilities keep their worth
Even when a vulnerability is years outdated, it’s not often too late to patch.
In August, the Federal Bureau of Investigation (FBI) warned that Russian state-sponsored menace actors linked to the Russian Federal Safety Service’s (FSB) Heart 16 had been conducting cyberespionage assaults in opposition to U.S. and different entities by actively focusing on Cisco units unpatched in opposition to a vulnerability from 2018. CTU researchers noticed comparable exercise by Russian state-sponsored menace actors in 2023.
The FBI was additionally considered one of a number of businesses within the U.S. and past to concern a warning about Chinese language state-sponsored menace actors compromising networks worldwide for espionage functions. The a part of the doc that lined how the attackers gained preliminary entry states that “they’re having appreciable success exploiting publicly identified frequent vulnerabilities” reasonably than beforehand unknown zero-day vulnerabilities. The doc lists the Cisco vulnerability from 2018, in addition to others from 2023 and 2024 that have an effect on edge units.
Organizations could not patch promptly for a lot of causes. Budgetary restrictions and restricted personnel are simply two components that may affect a patching program. Employees could lack consciousness of the vulnerability or not understand that impacted gear is in use. Some patches could require further analysis or should be changed with workarounds to keep away from potential affect to different business-critical operations. In some instances, gear is so outdated that distributors now not publish safety updates. Nonetheless, unpatched edge units put organizations in danger. Throughout incident response engagements that CTU researchers noticed in 2024, vulnerabilities in internet-facing units had been the commonest preliminary entry vectors.
The chance posed by unpatched units shouldn’t be going to say no. It’s already straightforward to make use of freely obtainable scanning programs and publicly obtainable exploit code to search out and exploit weak programs, and it’s possible that AI may automate this additional. Immediate patching in accordance with enterprise danger calculations or substitute of end-of-life programs stay extra vital than ever.
|
What You Ought to Do Subsequent
Monitor authorities and vendor advisories and different menace intelligence sources about menace actor |
Conclusion
Regardless of modifications in menace group composition and will increase in assault numbers, some features of the cyber menace stay the identical. Cybercriminals and state-sponsored menace actors proceed to benefit from easy accessibility to organizations’ environments. Thankfully, the fundamentals of fine cyber protection additionally stay fixed: immediate patching, phishing-resistant MFA, and complete monitoring and response.
