Cyble Explains How Organizations Can Quantify Cyber Risk in Financial Terms
Summary
Cyble argues that financial risk models can help organizations connect cyber threats to business impact and security investment decisions, citing 2025 ransomware and supply-chain trends while promoting its Cyber Risk Quantification platform.
Key points
- Cyble reports 6,604 ransomware attacks in 2025, up from 4,346 in 2024, and a 93% rise in supply-chain attacks.
- The article says identity and credential compromise was a leading initial-access vector, while ClickFix lures rose 517% year over year in the first half of 2025.
- Displaced ransomware affiliates shifted between operators, with Qilin and DragonForce absorbing many, according to the article.
- Cyble says its CRQ platform combines threat intelligence, asset visibility, and predictive analytics to estimate financial exposure and model security-control returns.
- The article cites estimates that the M&S ransomware incident could affect annual profit by about £300 million, illustrating the potential business cost of cyber incidents.
- Cyble also describes executive monitoring for impersonation, leaked information, dark-web exposure, and threats targeting organizational leadership.
Article Details
- Topic
- Cyber risk quantification and translating cyber exposure into financial impact for business decision-making.
CVE
CVE-2025-20337would remain attractive targets. Incidents involving Multer for Node.js, Microsoft SharePoint, CVE-2025-20337, and CVE-2025-5777 reinforced that concern. CVE-2025-5777attractive targets. Incidents involving Multer for Node.js, Microsoft SharePoint, CVE-2025-20337, and CVE-2025-5777 reinforced that concern.
Threat Actors
Black BastaRansomware group that became largely inactive following internal chat leaks and operational disputes.DevManNamed in connection with supply-chain activity demonstrating how IT providers and technology vendors can become pathways to multiple victims.DragonForceRansomware group that absorbed displaced affiliates.QilinRansomware group that absorbed displaced affiliates and was associated with supply-chain ransomware activity.RansomHubRansomware operator whose affiliates migrated to other operators after it went offline in April 2025.SafepayRansomware group associated with supply-chain activity; it claimed 58 victims in May 2025.Silk TyphoonThreat actor associated with campaigns targeting cloud and hybrid environments.
Malware
HelloGookieThe HelloKitty-to-HelloGookie transition provided another example of how underground communities support ransomware operations.HelloKittyThe HelloKitty-to-HelloGookie transition provided another example of how underground communities support ransomware operations.LockBit 5.0LockBit 5.0 emphasized third-party compromise, while activity associated with Qilin, SafePay (which claimed 58 victims in May 2025 alone), and DevMan demonstrated how IT providers and technology vendors can becomeMedusaThe FBI and CISA also issued joint warnings regarding Medusa ransomware, including the use of AI to streamline intrusion, escalate privileges, and evade detection.
Vendors
Products
Cyble CRQSee how Cyble CRQ turns cyber exposure into financial insight.Cyble SaratogaCyble Saratoga takes this approach further by combining cyber risk quantification with investment optimization, human and process risk analysis, scalable assessment models, and executive-ready dashboards.Executive MonitoringCyble’s Executive Monitoring capability extends visibility into these risks by monitoring for impersonation, leaked information, dark web exposure, and emerging threats targeting organizational leadership.
Countries
Chinawhile the UAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyber intrusions.TaiwanUAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyber intrusions.UAEHacktivist campaigns targeted energy, transportation, and government systems, while the UAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyberUnited StatesThe United States remained the primary target, accounting for 55% of attacks in 2025.
Industries
EnergyHacktivist campaigns targeted energy, transportation, and government systems, while the UAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyberFinancial ServicesFor financial services organizations, that can mean quantifying ransomware, fraud, credential compromise, and operational disruption.GovernmentHacktivist campaigns targeted energy, transportation, and government systems, while the UAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyberHealthcareHealthcare organizations can evaluate risks to patient data and critical systems – 423 healthcare ransomware attacks were recorded in the first nine months of 2025, with average ransom demands of USD 514,000 to USDManufacturingFor manufacturing and supply chains, it can mean assessing third-party exposure and potential downtime.TransportationHacktivist campaigns targeted energy, transportation, and government systems, while the UAE reported successfully blocking a major cyberattack against critical infrastructure, and China accused Taiwan of targeted cyber