Stolen Credentials Fuel Ransomware, Supply-Chain and Nation-State Attacks
Summary
The article links industrial-scale credential theft to ransomware, SaaS and supply-chain attacks, and geopolitical operations, citing 2025 trends and recommending closer monitoring of human and machine identity activity.
Key points
- Ontinue reports LummaC2 credential listings rose 72%, with high-privilege cloud credentials listed for $1,000–$15,000 or more.
- The article says more than 7,000 ransomware incidents and 129 active groups were tracked through 2025; ransom payments fell from $892 million in 2024 to $820 million in 2025.
- Ransomware extortion increasingly combines data theft with operational disruption, including wiping systems, deleting backups and targeting OT/ICS-adjacent services.
- Ontinue reports meaningful signs of LLM-assisted malware development in the second half of 2025, while noting that this is not autonomous malware.
- The article cites the Salesloft Drift OAuth campaign, with more than 700 victim organizations, and the Shai-Hulud npm worm as examples of attacks abusing business trust and credentials.
- It recommends assuming attackers may obtain legitimate identities and monitoring authentication and access activity across human and non-human accounts.
Article Details
- Topic
- Stolen credentials and identity abuse as drivers of ransomware, supply-chain and SaaS attacks, and geopolitical cyber activity
People
Mark McClainSailPoint's CEO, quoted on adaptive identity and monitoring abnormal access activity.Nathaniel JonesDarktrace's VP of security and AI strategy and field CISO, quoted on attackers using double- and triple-extortion strategies.Trey FordBugcrowd's chief strategy and trust officer, quoted on ransomware groups shifting toward smaller targets and payments.
Threat Actors
Ghost BlizzardNamed in the article in connection with wiper attacks targeting Polish civilian infrastructure.Lazarus GroupNamed in the article as responsible for a $1.5 billion cryptocurrency theft attributed to North Korea.Shai-HuludThe article describes a financially motivated Shai-Hulud actor associated with an npm worm and willingness to delete a target's home directory when little data is available to steal.
Malware
Products
Countries
IranPrompted by the US/Israel war against Iran, Iranian actors used wipers in the attack against Stryker earlier this year.North KoreaOntinue quotes three examples: North Korea’s Lazarus Group $1.5B cryptocurrency theft; wiper attacks targeting Polish civilian infrastructure by Ghost Blizzard; and record-setting DDoS activity peaking at 31.4 Tbps via