Ransomware Ecosystem Update: Leading Groups, RaaS Expansion, and Termite’s ClickFix Adoption
Reporting highlights a broader shift in the ransomware ecosystem toward platform-like operations and ransomware-as-a-service (RaaS) models that lower the barrier to entry and accelerate the creation of new crews. Huntress telemetry for 2025 is cited as placing Akira as a leading ransomware group, with operators increasingly targeting the hypervisor layer to bypass traditional endpoint controls; separate commentary describes rapid victim growth for Qilin (claimed to exceed 1,000 victims in 2025) and notes LockBit regaining operational capability after prior disruption. The same reporting also points to “Extortion-as-a-Service” offerings (including a federation described as SLSH—Scattered Spider/Lapsus$/ShinyHunters) that enable affiliates to rent tooling rather than develop it, contributing to a surge in newly formed groups.
A separate technical write-up details Termite ransomware as a Babuk-derived operation first observed in late 2024 that has matured into a multi-stage intrusion and double-extortion threat, claiming dozens of victims across multiple sectors and regions by March 2026. The report emphasizes Termite’s operationalization of ClickFix (browser-based social engineering) to bypass traditional phishing defenses, and provides a distinctive forensic marker: encrypted files reportedly have the Babuk-inherited trailing string "choung dong looks like hot dog", positioned as a practical indicator during triage. Another overview article catalogs major active ransomware groups and tactics, including Lynx (described as sharing substantial code with INC, using double extortion, appending .lynx, and deleting shadow copies) and Medusa, while reiterating law-enforcement attribution and indictments tied to LockBit leadership and deployment activity.
Sources
Related Stories
Ransomware and initial-access tradecraft evolves with new evasion and extortion techniques
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
2 months ago
Ransomware and Cyber-Extortion Trends: Shift to Data Theft and Evolving RaaS Ecosystem
Cyber insurance and threat reporting indicate **ransomware operators are increasingly leaning on data theft and extortion** as organizations improve backup and recovery. Coalition’s 2025 claims data (across 100,000+ policyholders) shows **business email compromise (BEC)** and **funds transfer fraud (FTF)** dominated claims volume, while **ransomware** represented a smaller share but featured **sharply higher initial demands** (average just over **$1.0M**, with some as high as **$16M**) even as average loss severity declined—consistent with improved restoration and response reducing the leverage of pure encryption-only attacks. In parallel, the broader ransomware ecosystem continues to **reorganize rather than shrink** despite sustained law-enforcement disruption of major RaaS brands (e.g., LockBit/Hive/ALPHV), with reporting citing high victim-post volumes across dozens of active operations. Halcyon reported a **tactical shift among pro-Iranian/pro-Palestinian-aligned operators** away from *Sicarii* toward **BQTLock (Baqiyat 313 Locker)**, including promotion of “free” RaaS access via Telegram and targeting focused on the UAE, US, and Israel. Separately, **ShinyHunters** claimed a major theft from AI merchant-data platform *Woflow* (alleging internal data, PII, and transaction/order details) but provided no sample for verification at the time of reporting, while a separate SC Media piece used the **SoundCloud** incident (reported exposure of data tied to ~**29.8M** accounts) to highlight incident-response and crisis-management considerations rather than new technical findings.
1 weeks ago
Ransomware and Extortion Trend Reporting and Threat-Activity Roundups
Multiple sources published **trend-focused reporting** on ransomware/extortion rather than describing a single discrete incident. Analyst1’s 2025 year-in-review reports a record rise in ransomware **data leak site (DLS)** postings (7,819 claims in 2025, up ~49.7% YoY), with the **U.S.** representing roughly half of observed claims and a concentration of activity among a small set of groups (e.g., **Qilin**, **Akira**, **CLOP**, **PLAY**). Ransom-DB similarly promotes ongoing “weekly trends” and group analyses (e.g., Qilin and other crews driving high weekly volumes), reinforcing that extortion ecosystems continue to scale and diversify across geographies and sectors. Several other items in the set are **not about ransomware trend reporting** and should be treated as separate stories: Kaspersky-reported supply-chain compromise of Android tablet firmware with the **Keenadu** backdoor (persistence via Android `Zygote`), Dragos reporting continued PRC-linked **Volt Typhoon/Voltzite** activity in U.S. energy/OT environments, and a Check Point weekly bulletin summarizing multiple unrelated breaches (e.g., Odido, BridgePay, Flickr, ApolloMD) plus AI-misuse research. Additional content is either **generic thought leadership** (cybersecurity predictions; secure-by-design op-ed) or **out-of-timeframe/marketing-leaning reposting** (Arete summarizing a 2020 TrickBot healthcare alert; identity-attack discussion based on an IR report), and does not materially contribute to a single cohesive event narrative.
3 weeks ago