Last Year in Ransomware: Threat Trends and Outlook for 2025

The report reviews ransomware trends heading into 2025, profiling active and emerging groups (Akira, RansomHub, Cl0p and others), describing shifts toward decentralised and encryption-less extortion, the growing use of AI for crafting attacks, and frequent exploitation of unpatched VPNs and web applications (notably several CVEs). It emphasizes living-off-the-land techniques, credential theft (e.g., Mimikatz), SIM swapping, and RaaS offerings that lower attacker skill barriers, and recommends capability-based defenses: faster patching, behavior-based detection, strong access controls, and updated security awareness.