cyber.hendryadrian.com
Security Report · cloud.google.com

Google Details 2025 Ransomware Trends and Tactics

· Original article ↗

Summary

GTIG's review of Mandiant's 2025 ransomware cases found vulnerability exploitation in about one-third of intrusions, suspected or confirmed data theft in 77%, and virtualization targeting in 43%. REDBIKE appeared in nearly 30%.

Key points

  • The analysis covers Mandiant-led 2025 incidents involving post-compromise ransomware deployment; it excludes activity focused only on data-theft extortion and represents a sample, not global activity.
  • Vulnerability exploitation or suspected exploitation was the initial access vector in about one-third of incidents, often targeting VPNs and firewalls; GTIG also identified evidence of possible zero-day exploitation.
  • Suspected or confirmed data theft occurred in 77% of analyzed intrusions, up from 57% in 2024; Rclone was used in 28% of cases where data theft was suspected or confirmed.
  • Virtualization infrastructure was targeted in about 43% of incidents, up from 29% in 2024; some actors automated ransomware deployment against ESXi hosts.
  • REDBIKE was the most frequently observed ransomware family, appearing in almost 30% of investigated incidents.
  • Common tactics included credential theft, lateral movement via RDP, SMB, and SSH, use of tunnelers, disabling security controls, and deleting backups or Volume Shadow Copies.
  • Data leak site posts rose almost 50% over 2024, but GTIG cautions that posts can include data-theft-only activity and fabricated, exaggerated, or repeated claims, so they are not a reliable measure of total ransomware activity.

Article Details

Publisher
Google Threat Intelligence Group (GTIG)
Report Period
2025
Scope
Ransomware incidents investigated by Mandiant Consulting across multiple regions and industries; data-theft-only incidents were excluded from the TTP analysis.
Sample Size
Not disclosed
Key Statistics
  • Confirmed or suspected vulnerability exploitation accounted for one-third of analyzed ransomware incidents.
  • Confirmed or suspected data theft occurred in approximately 77% of analyzed intrusions, compared with approximately 57% in 2024.
  • Virtualization infrastructure was targeted in approximately 43% of investigated intrusions, compared with 29% in 2024.
  • REDBIKE accounted for approximately 30% of analyzed ransomware incidents.
  • RDP was used for lateral movement in approximately 85% of intrusions.

MITRE ATT&CK

T1003.001 · LSASS MemoryActors dumped LSASS process memory to obtain credentials.T1021.001 · Remote Desktop ProtocolActors used RDP with compromised or created accounts for lateral movement.T1021.002 · SMB/Windows Admin SharesActors used SMB shares to move laterally and stage payloads.T1021.004 · SSHActors used SSH to move laterally, particularly to ESXi hosts.T1053.005 · Scheduled TaskActors registered Windows scheduled tasks to run tunnelers and ransomware.T1059.001 · PowerShellActors used PowerShell for reconnaissance, credential access and ransomware deployment.T1078 · Valid AccountsActors used compromised or attacker-created accounts for access and lateral movement.T1110 · Brute ForceActors conducted brute-force attacks against VPN accounts and other accounts.T1189 · Drive-by CompromiseMalvertising and search-engine optimization were used to distribute initial malware payloads.T1190 · Exploit Public-Facing ApplicationActors exploited or were suspected of exploiting vulnerabilities in exposed services, particularly VPNs and firewalls, for initial access.T1490 · Inhibit System RecoveryActors deleted backups and snapshots or impaired backup systems before encryption.T1555 · Credentials from Password StoresActors targeted credentials stored in browsers and password managers.T1558.003 · KerberoastingKerberoasting was among the observed methods targeting Windows authentication.T1562.001 · Disable or Modify ToolsActors disabled or modified security controls, including Windows Defender settings.T1567 · Exfiltration Over Web ServiceActors used cloud services and synchronization utilities to exfiltrate stolen data.

CVE

CVE-2019-6693Fortinet · FortiGatevulnerabilities in common VPNs and firewalls such as Fortinet (CVE-2024-55591, CVE-2024-21762, and CVE-2019-6693), SonicWall (CVE-2024-40766), Palo Alto (CVE-2024-3400), and Citrix (CVE-2023-4966).CVE-2023-4966Citrix · NetScaler ADC; Citrix · NetScaler Gatewayand CVE-2019-6693), SonicWall (CVE-2024-40766), Palo Alto (CVE-2024-3400), and Citrix (CVE-2023-4966).CVE-2024-21762Fortinet · FortiOS; Fortinet · FortiProxy[CVE ] exploited vulnerabilities used for initial access – CVE-2024-21762 (Fortinet), CVE-2025-53770 (Microsoft SharePoint), and multiple other CVEs referenced in Table 1.CVE-2024-3400Palo Alto Networks · PAN-OS; paloaltonetworks · pan-osFortinet (CVE-2024-55591, CVE-2024-21762, and CVE-2019-6693), SonicWall (CVE-2024-40766), Palo Alto (CVE-2024-3400), and Citrix (CVE-2023-4966).CVE-2024-37085vmware · cloud_foundation; vmware · esxiDuring one ransomware incident targeting a victim’s virtualized environment, the threat actor exploited CVE-2024-37085 to gain administrator access to an ESXi hypervisor.CVE-2024-40766SonicWall · SonicOSVPNs and firewalls such as Fortinet (CVE-2024-55591, CVE-2024-21762, and CVE-2019-6693), SonicWall (CVE-2024-40766), Palo Alto (CVE-2024-3400), and Citrix (CVE-2023-4966).CVE-2024-55591Fortinet · FortiOS; Fortinet · FortiProxysuspected, the threat actors targeted vulnerabilities in common VPNs and firewalls such as Fortinet (CVE-2024-55591, CVE-2024-21762, and CVE-2019-6693), SonicWall (CVE-2024-40766), Palo Alto (CVE-2024-3400), andCVE-2025-53770Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 more[CVE ] exploited vulnerabilities used for initial access – CVE-2024-21762 (Fortinet), CVE-2025-53770 (Microsoft SharePoint), and multiple other CVEs referenced in Table 1.CVE-2025-53771Microsoft · Microsoft SharePoint Enterprise Server 2016; Microsoft · Microsoft SharePoint Server 2019; +1 moreDuring mid-July 2025, an UNC6357 actor attempted to exploit Microsoft Sharepoint vulnerabilities CVE-2025-53770 and CVE-2025-53771 to gain access to the victim’s environment and ultimately deploy LOCKBIT.WARLOCK.CVE-2025-61882Oracle Corporation · Oracle Concurrent ProcessingWhile the observed incidents did not involve ransomware deployment, threat actors associated with the CL0P DLS may have exploited CVE-2025-61882 as a zero-day against Oracle EBS environments.CVE-2025-8088win.rar GmbH · WinRARIn August 2025, GTIG assessed with high confidence that UNC2165 leveraged a zero-day exploit for CVE-2025-8088 to deploy MYTHICAGENT.

Threat Actors

EvilCorpGTIG assessed with high confidence that the cluster used a CVE-2025-8088 zero-day exploit to deploy MYTHICAGENT; it also investigated a RANSOMHUB intrusion involving the cluster.FIN6UNC6021 is described as a suspected FIN6 threat cluster; the reported infection chain involved a malicious site and multiple downloader and backdoor payloads.GunraA 2025 incident associated with this ransomware group involved deployment of a payload heavily based on CONTI source code.UNC2465Distributed SMOKEDHAM through malvertising or SEO and was observed in an AGENDA intrusion that included exfiltration of a Bitwarden vault database.UNC5471Used archiving and exfiltration utilities and created registry Run keys in an intrusion involving AGENDA ransomware.UNC5495Automated BABUK.MARIO deployment to ESXi hosts using a batch script and KiTTY.UNC5833Gained access from an initial access partner in an intrusion that led to CLOP deployment.UNC6016Used malvertising to distribute malware masquerading as legitimate software; some observed access operations led to NITROGEN or RHYSIDA deployments.UNC6021A suspected FIN6 threat cluster that used SQUIDGATE to deploy FIREHAWK and modified firewall rules during an intrusion.UNC6357Attempted to exploit SharePoint vulnerabilities before deploying LOCKBIT.WARLOCK; Mandiant reported evidence suggesting the same actor had attempted zero-day exploitation.

Malware

BABUK.MARIODuring an UNC5495 intrusion, the threat actor automated the deployment of BABUK.MARIO by leveraging a batch script that accepted credentials for ESXi hosts.ClopThe ecosystem showed signs of declining profitability and operational shifts—such as increased targeting of smaller organizations, use of tunnelers and RMM abuse, and integration of AI and Web3—withINC ransomware[File name ] ransom/readme and payload filenames – ‘akira_readme.txt’, ‘INC-README’, and other ransom note/readme filenames observed in deployed ransomware.LOCKBIT.WARLOCKdespite law enforcement and actor disruptions, with new or rebranded operators (e.g., Qilin, Akira, LOCKBIT.WARLOCK) filling vacuums and some actors adopting AI and Web3 technologies.Qilin‘ff67c703589f775db9aed5a03e4489b0’ (SAFEPAY) and multiple YARA rule strings/hex patterns provided for AGENDA, REDBIKE, CLOP, INC, PLAYCRYPT, and others.RansomHubor significant debilitation of previously prolific RaaS groups like LockBit, ALPHV, Basta, and RansomHub.REDBIKEcontinued targeting of VPNs/firewalls via vulnerability exploitation, and a notable prevalence of REDBIKE ransomware.RhysidaAt least a portion of observed UNC6016 access operations ultimately lead to NITROGEN or RHYSIDA ransomware deployments.SMOKEDHAMUNC2465 routinely leveraged malvertising and/or SEO techniques to distribute SMOKEDHAM payloads masquerading as RVTOOLs installers.SystemBCvia RDP/SMB/SSH, and persistence via scheduled tasks, services, and tunnelers (CLOUDFLARED, VIPERTUNNEL, SYSTEMBC).

Vendors

CitrixExploitation of vulnerabilities was the most common initial access vector, frequently targeting VPN and firewall products such as Fortinet, SonicWall, Palo Alto, and Citrix.FortinetExploitation of vulnerabilities was the most common initial access vector, frequently targeting VPN and firewall products such as Fortinet, SonicWall, Palo Alto, and Citrix.Microsoft[CVE ] exploited vulnerabilities used for initial access – CVE-2024-21762 (Fortinet), CVE-2025-53770 (Microsoft SharePoint), and multiple other CVEs referenced in Table 1.Palo Alto NetworksExploitation of vulnerabilities was the most common initial access vector, frequently targeting VPN and firewall products such as Fortinet, SonicWall, Palo Alto, and Citrix.SonicWallExploitation of vulnerabilities was the most common initial access vector, frequently targeting VPN and firewall products such as Fortinet, SonicWall, Palo Alto, and Citrix.

Products

ESXiIn ~43% of incidents threat actors targeted virtualization infrastructure (ESXi/vCenter), and some operations automated portions of ransomware deployment against virtual hosts.FortiOSFortiOS / FortiProxyFortiProxyFortiOS / FortiProxyMicrosoft SharePoint[CVE ] exploited vulnerabilities used for initial access – CVE-2024-21762 (Fortinet), CVE-2025-53770 (Microsoft SharePoint), and multiple other CVEs referenced in Table 1.VMware vCenter ServerIn ~43% of incidents threat actors targeted virtualization infrastructure (ESXi/vCenter), and some operations automated portions of ransomware deployment against virtual hosts.Windows DefenderActors engaged in anti-detection and anti-recovery tactics such as disabling Windows Defender, deleting backups and VSS, clearing logs, and tampering with backup systems to frustrate recovery efforts.

Tools

AdaptixC2However, multiple threat clusters used other post-exploitation frameworks like AdaptixC2 (ADAPTAGENT), Exploration C2 (EXPLORATIONC2), or MYTHIC.Cloudflaredlateral movement via RDP/SMB/SSH, and persistence via scheduled tasks, services, and tunnelers (CLOUDFLARED, VIPERTUNNEL, SYSTEMBC).ImpacketSoftperfect Network Scanner (NETSCAN), and Angry IP Scanner, to red-teaming tools like PowerSploit and IMPACKET.MEGAsyncApproximately 77% of analyzed ransomware intrusions included suspected or confirmed data theft, up from ~57% in 2024, with tools like Rclone and MEGASync commonly used for exfiltration.MimikatzCommon post-compromise techniques included credential theft (MIMIKATZ, LSASS/NTDS dumps), lateral movement via RDP/SMB/SSH, and persistence via scheduled tasks, services, and tunnelers (CLOUDFLARED, VIPERTUNNEL,NetExecIn one LOCKBIT.WARLOCK intrusion, the threat actor staged NetExec on a domain controller along with files to run the ransomware payload.netscanransomware (‘leveraged SMB to access various network shares and used this access to stage a copy of NETSCAN on multiple hosts’).RCloneApproximately 77% of analyzed ransomware intrusions included suspected or confirmed data theft, up from ~57% in 2024, with tools like Rclone and MEGASync commonly used for exfiltration.TerminatorExamples include the open-source TERMINATOR and WATCHDOGKILLER, as well as non-publicly available tools such as WARCLAW, a utility that decodes and installs a vulnerable kernel mode driver.WATCHDOGKILLERExamples include the open-source TERMINATOR and WATCHDOGKILLER, as well as non-publicly available tools such as WARCLAW, a utility that decodes and installs a vulnerable kernel mode driver.

Related Articles