Extortion and Ransomware Trends January-March 2025
Summary: Unit 42's January-March 2025 leak site review found RansomHub the most prolific ransomware group in public reports, with activity rising from January to February and dipping slightly in March in both 2024 and 2025. The report also documents scammers mailing threatening letters in March 2025 posing as BianLian (which the FBI assessed as a scam), a fake Babuk rebrand re-extorting more than 60 victims with old data, and North Korean group Moonstone Sleet reportedly deploying Qilin payloads in a limited number of attacks.
What's compelling: Unit 42's 2025 Global Incident Response Report found 86% of incidents involved business disruption, and attackers are now adopting EDR killers that terminate defensive software so data can be encrypted before anyone notices.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026