Crimeware Report Trends and Highlights from Q1 2025

This report presents an analysis of crimeware trends and highlights observed during the first quarter of 2025. Arete identified notable patterns in ransomware and extortion incidents, focusing on the most active threat groups, ransom demands, and the tools and methods employed by attackers. The report indicates that established groups such as Akira and RansomHub were the most active, with Akira responsible for over 15% of engagements. The document details the emergence of new groups and the persistence of established ones, while also noting the impact of internal issues within RansomHub. Additionally, the report discusses the use of social engineering tactics and specific vulnerabilities exploited by these groups. It highlights the leaking of internal chat logs from the Black Basta group, revealing their operational strategies and the tools they utilize for attacks. The report concludes with a discussion on the evolving nature of cyber threats and the challenges in attributing them accurately.