Ransomware in 2025: Blending in is the strategy
Summary: Cisco Talos's 2025 Year in Review data shows ransomware actors now operate through legitimate-looking access, with phishing the entry point 40% of the time, and RDP, PowerShell, and PsExec as their top three tools. Qilin ranked No. 1 among ransomware-as-a-service groups with a double-extortion approach, targeting more than 40 victims every month except January, while LockBit fell from first place in 2024 to 35th following sustained law enforcement pressure.
What you should know: The tools attackers use most - RDP, PowerShell, and PsExec - are the same ones already running in normal operations, so the difference is behavior, not binaries, and valid accounts appear at nearly every stage from initial access to execution. Manufacturing remains the most targeted sector, and Qilin's pace of more than 40 victims a month signals it will stay a significant threat into 2026.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026