Symantec Report Tracks Rising Encryptionless Extortion and New Ransomware Actors
Report discovered via Awesome Annual Security Reports.
Summary
Symantec and Carbon Black report 6,182 claimed extortion attacks in 2025, up 23% when encryptionless attacks are included. The study examines ransomware affiliate migration, Warlock’s possible espionage links, and widespread abuse of legitimate tools.
Key points
- Leak-site analysis counted 4,737 claimed ransomware attacks in 2025, up 0.8% from 2024. Including encryptionless extortion raised the total to 6,182, a 23% increase, using leak-site claims and publicly reported victim counts.
- RansomHub’s April 2025 shutdown caused only a brief activity decline as affiliates migrated to other operations. Akira and Qilin each accounted for 16% of claimed ransomware attacks during the year.
- The report describes ShinyHunters impersonating IT support to persuade Salesforce users to authorize attacker-controlled OAuth applications, enabling extensive data access and exports for extortion.
- Warlock investigations identified DLL sideloading and defense-evasion tools signed with a stolen certificate previously linked to espionage-related activity. The researchers suggest possible historical actor connections rather than establishing definitive attribution.
- SonicWall’s investigation attributed Akira-linked intrusions initially suspected to involve a zero-day to incomplete remediation of CVE-2024-40766 during Gen 6-to-Gen 7 migrations.
- A Play-linked intrusion exploited Windows CLFS vulnerability CVE-2025-29824 before its April 2025 patch, enabling credential dumping and creation of a privileged account; no ransomware was deployed in that intrusion.
- The report highlights widespread use of legitimate administration tools and vulnerable drivers to evade defenses. Inc-linked investigations found Restic exfiltration to a shared Wasabi account, with the tool present for at least two months before encryption in one organization.
Article Details
- Publisher
- Symantec and Carbon Black Threat Hunter Team
- Report Period
- 2025
- Scope
- Ransomware and encryptionless extortion activity, leak-site claims, actor profiles, investigated intrusions, attack techniques, and defensive practices.
- Key Statistics
- Ransomware leak-site analysis counted 4,737 claimed attacks in 2025 versus 4,701 in 2024, a 0.8% increase. These are actor claims, not independently confirmed incidents.
- Including encryptionless extortion, the report counted 6,182 extortion attacks in 2025, a reported 23% increase over 2024. Some encryptionless figures derive from publicly reported victim counts rather than leak-site claims.
- Akira and Qilin each accounted for 16% of claimed ransomware attacks in 2025; Inc and Safepay each accounted for 6%, and DragonForce accounted for 5%.
- Attackers deploying Akira reportedly carried out at least 40 attacks exploiting CVE-2024-40766 in August and September 2025.
- In at least one investigated Inc intrusion, Restic appeared to have been present on the victim network for at least two months before ransomware execution.
- Recommendations
- Monitor dual-use and administrative tool usage, establish normal-use profiles, and apply application allowlisting where appropriate.
- Keep PowerShell current, enable logging, and restrict its capabilities through controls such as constrained language mode.
- Restrict RDP to known IP addresses, require MFA, audit administrative account usage, and use one-time administrative credentials.
- Maintain off-site and offline backups, secure backup permissions, and regularly test restoration against business requirements.
- Prepare an incident response plan with external notification procedures and keep critical administrative information and troubleshooting resources offline.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 47[.]109[.]200[.]130 | Suspicious IP address used to host a RustDesk installation package downloaded during a July 2025 LockBit 3.0 attack. |
| SHA256 | f6ee01303cf1d68015eee49f7dc7f26151a04ae642a47e49c70806931ce652d3 | Vulnerable Baidu antivirus driver deployed in investigated Warlock attacks to disable security software through BYOVD; renamed googleapiutil64.sys. |
| URL | hxxp[:]//77[.]221[.]149[.]107:8000/appverifUI.dll | Suspicious DLL download URL shown in an example of malicious PowerShell activity. |
MITRE ATT&CK
T1003.001 · LSASS MemoryThe report documents LSASS memory dumping with ProcDump and credential extraction with Mimikatz.T1003.002 · Security Account ManagerAttackers dump the SAM registry hive with reg.exe; a Balloonfly exploit chain also dumps SAM, SYSTEM, and SECURITY hives.T1021.002 · SMB/Windows Admin SharesAttackers use PsExec and administrative shares for lateral execution and ransomware deployment.T1047 · Windows Management InstrumentationAttackers use WMI for remote command execution, enumeration, and lateral movement.T1059.001 · PowerShellAttackers execute PowerShell commands for payload downloads, reconnaissance, credential dumping, and defense impairment.T1068 · Exploitation for Privilege EscalationBalloonfly exploited the Windows CLFS privilege escalation vulnerability CVE-2025-29824 before disclosure and patching.T1078 · Valid AccountsRansomware actors obtain valid stolen, weak, or default credentials, including access purchased from initial access brokers.T1190 · Exploit Public-Facing ApplicationActors exploit public-facing MOVEit Transfer, Oracle E-Business Suite, SharePoint, VPN, and other server installations for access.T1219 · Remote Access ToolsAttackers abuse remote access software including AnyDesk, Atera, ScreenConnect, MeshAgent, and RustDesk to access victim systems.T1486 · Data Encrypted for ImpactMultiple profiled ransomware operations encrypt victim files and systems to demand payment.T1490 · Inhibit System RecoveryQilin.B deletes Volume Shadow Copies, and the report documents shadow-copy deletion commands used to hinder recovery.T1562.001 · Disable or Modify ToolsRansomware attackers disable antivirus and EDR through vulnerable drivers, operational scripts, registry changes, and security-process termination.T1566 · PhishingWarble uses spear-phishing emails for initial compromise.T1567.002 · Exfiltration to Cloud StorageInc attackers use Restic to exfiltrate data to Wasabi buckets; Warble also uses MegaSync for data exfiltration.T1574.002 · DLL Side-LoadingWarlock attackers use 7z.exe to sideload malicious 7z.dll, while Akira attack chains sideload Bumblebee through legitimate executables.
CVE
CVE-2020-1472the attackers gained initial access by exploiting the Zerologon vulnerability (CVE-2020-1472). Attackers deployingCVE-2020-3259Akira attackers are also known to have exploited vulnerabilities in Cisco devices (CVE-2020-3259 and CVE-2023-20269) for initial access.CVE-2023-20269Akira attackers are also known to have exploited vulnerabilities in Cisco devices (CVE-2020-3259 and CVE-2023-20269) for initial access.CVE-2023-225152023-46604), and Confluence (CVE-2023-22515). In some RansomHub attacks investigated by the Threat Hunter Team,CVE-2023-27997such as CitrixBleed (CVE-2023-3519), Fortinet FortiOS (CVE-2023-27997), Java OpenWire protocol marshaller (CVE-CVE-2023-29357in SharePoint (CVE-2023-29357) which was subsequently used by multiple ransomware actors to elevate privileges. IPSCVE-2023-34362Snakefly had been exploiting the vulnerability (CVE-2023-34362), an SQL injection vulnerability that permits an unauthenticated attacker to gain access to MOVEit Transfer's database, as a zero-day vulnerability prior toCVE-2023-3519such as CitrixBleed (CVE-2023-3519), Fortinet FortiOS (CVE-2023-27997), Java OpenWire protocol marshaller (CVE-CVE-2024-40711The vulnerability targeted by the attackers was a critical unauthenticated remote code execution vulnerability (CVE-2024-40711) caused by deserialization of untrusted data.CVE-2024-40766The attackers were exploiting a known security weakness associated with a critical vulnerability, CVE-2024-40766 (CVSS score: 9.8), first disclosed in August 2024.CVE-2024-57727Balloonfly was also reported to have exploited the vulnerability in the remote monitoring and management (RMM) tool SimpleHelp (CVE-2024-57727).CVE-2025-29824The Threat Hunter Team also found evidence of Balloonfly exploiting a zero-day Windows privilege escalation vulnerability (CVE-2025-29824) prior to it being patched on April 8, 2025.CVE-2025-53770Having first appeared in June 2025, Warlock ransomware hit the headlines only weeks after it was discovered exploiting the ToolShell zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770) on July 19, 2025.CVE-2025-61882Snakefly gained access by exploiting a critical zero-day vulnerability tracked as CVE-2025-61882 (CVSS score: 9.8) in the EBS product that allowed unauthenticated attackers to remotely execute code on vulnerable systems.
People
Dimitry KhoroshevAlleged LockBit ringleader, also known as LockBitSupp, indicted in the U.S. in May 2024; the indictment places him and other key figures in Russia.salfetkaIndividual who claimed in May 2024 to be selling Inc ransomware source code for $300,000; the report states that the legitimacy of the sale was unclear.
Threat Actors
BalloonflyOperates Play ransomware and exploited CVE-2025-29824 as a zero-day; aliases are Play and PlayCrypt.BITWISE SPIDERAlias of Syrphid, the group running LockBit ransomware-as-a-service.CamoFeiTeamT5 name for an apparently Chinese group involved in espionage, denial-of-service, and ransomware; SentinelOne calls the group ChamelGang.ChamelGangSentinelOne name for the group called CamoFei by TeamT5; associated with attacks across several countries and the CatB ransomware.Cl0pOperation run by Snakefly; the report also explicitly identifies Cl0p as a name for Snakefly.CyCl0psListed as an alias of Greenbottle in the actor profile.DarterOperates the Akira ransomware-as-a-service operation, active since 2023.Dimitry KhoroshevAlleged LockBit ringleader indicted in the U.S.; explicitly identified as also known as LockBitSupp.DragonForceAlias of Hackledorb, which collaborated with Scattered Spider for attacks on UK retailers.GreenbottleDevelops RansomHub; aliases are RansomHub and CyCl0ps. Its operation appeared to go offline in April 2025.INCAlias of Warble, the group developing and operating Inc ransomware.LAPSUS$Group linked to credential theft, social engineering, and high-profile breaches; believed to participate in Scattered LAPSUS$ Hunters.LockBitAlias of Syrphid, whose operation suffered law-enforcement disruption and subsequent infrastructure compromise.LockBitSuppAlias of Dimitry Khoroshev, the alleged LockBit ringleader indicted in the U.S.PlayAlias of Balloonfly, the group operating Play ransomware.PlayCryptAlias of Balloonfly, the group operating Play ransomware.QilinAlias of Stinkbug, the operator of the Qilin ransomware family.RansomHubAlias of Greenbottle, whose ransomware-as-a-service operation appeared to shut down in April 2025.Scattered Lapsus$ HuntersBelieved collaboration between Scattered Spider, ShinyHunters, and LAPSUS$ offering extortion-as-a-service; shared Oracle EBS exploit scripts on Telegram.Scattered SpiderSocial-engineering group that deployed DragonForce against UK retailers in 2025; believed to participate in Scattered LAPSUS$ Hunters.ShinyHuntersData-theft and extortion group linked to Salesforce customer attacks and malicious OAuth application authorization; believed to participate in Scattered LAPSUS$ Hunters.SnakeflyRuns the Cl0p operation and conducts data-theft extortion through mass exploitation; the report also identifies Cl0p as an alternate name.StinkbugOperates Qilin ransomware-as-a-service; the report lists Qilin, Agenda, and Water Galura as aliases.Water GaluraListed as an alias of Stinkbug, the Qilin ransomware operator.
Malware
AkiraIts collapse only resulted in a brief drop in ransomware attacks, with former RansomHub affiliates quickly migrating to work with other threats such as Qilin, Akira, and DragonForce.Backdoor.BetrugerIn March 2025, the Threat Hunter Team reported that at least one affiliate of the RansomHub RaaS was using a new custom backdoor called Backdoor.Betruger in attacks.BumbleBee**Case Study: Akira Attackers Use Bumblebee Loader**CatBIts ransomware payload, known as CatB, had been signed with the same coolschool certificate.DragonForceIts collapse only resulted in a brief drop in ransomware attacks, with former RansomHub affiliates quickly migrating to work with other threats such as Qilin, Akira, and DragonForce.GrixbaAlthough no ransomware payload was deployed in the intrusion, the attackers deployed the Grixba infostealer, which is a custom tool associated with Balloonfly.INC ransomwareOther players have benefited significantly from these departures, most notably Akira (16% of claimed attacks), Qilin (16%), Inc (6%), Safepay (6%), and the new arrival DragonForce (5%).LEMURLOOTThe exploit was used to compromise public-facing MOVEit Transfer installations with a webshell named Lemurloot.LockBitLockBit (also known as Syrphid) and RansomHub (also known as Greenbottle), two of the largest ransomware-as-a-service (RaaS) operations seen to date disappeared from the scene in 2025.Play**Aliases:** Play, PlayCryptQilinIts collapse only resulted in a brief drop in ransomware attacks, with former RansomHub affiliates quickly migrating to work with other threats such as Qilin, Akira, and DragonForce.RansomHubDuring 2025, RansomHub (the number one ransomware operation) disappeared from the scene virtually overnight.Sh1nySp1d3rmake up the majority of the group’s offerings, the existence of a new custom ransomware family named Sh1nySp1d3r has also been hinted at, with an early Windows version seen in the wild.Warlock- [Warlock Ransomware: A New Breed of Threat?](#warlock-ransomware-a-new-breed-of-threat)
Vendors
Carbon BlackAn Analysis from the Symantec® and Carbon Black® Threat Hunter TeamCiscoThe wave of attacks impacted numerous companies, including Google, Farmers Insurance, Allianz Life, Workday, Pandora, Cisco, Chanel, and Qantas.FortinetBalloonfly frequently targets victims using exploits for known vulnerabilities and has also exploited vulnerabilities in Microsoft Exchange and Fortinet FortiOS software.Fortraout these types of attacks more regularly and reportedly exploited a zero-day vulnerability in the Fortra GoAnywhere MFT secure file-sharing solution to access the networks of 130 companies.MicrosoftThe group was linked to a string of high-profile breaches at companies including Microsoft, Cisco, Samsung, Nvidia, and Okta.OracleIn October 2025, it was linked to extortion attacks that targeted users of Oracle E-Business Suite (EBS).SonicWallIn August 2025, it was reported that attackers deploying Akira may have been exploiting a zero-day vulnerability in SonicWall SSL VPN devices.SymantecAn Analysis from the Symantec® and Carbon Black® Threat Hunter TeamVeeamIn October 2024, users of Veeam Backup & Replication servers were warned that the Akira and Fog ransomware groups were starting to target vulnerable Veeam installations for ransomware attacks.
Products
Carbon Black CloudRecent, independent testing by SE Labs found that both Symantec Endpoint Security Complete and Carbon Black CloudConfluence2023-46604), and Confluence (CVE-2023-22515). In some RansomHub attacks investigated by the Threat Hunter Team,FortiOSBalloonfly frequently targets victims using exploits for known vulnerabilities and has also exploited vulnerabilities in Microsoft Exchange and Fortinet FortiOS software.Microsoft Exchange ServerExchange Server for initial access. They then executed a PowerShell command to download and execute Cobalt StrikeMicrosoft SharePointHaving first appeared in June 2025, Warlock ransomware hit the headlines only weeks after it was discovered exploiting the ToolShell zero-day vulnerability in Microsoft SharePoint (CVE-2025-53770) on July 19, 2025.Oracle E-Business SuiteIn October 2025, it was linked to extortion attacks that targeted users of Oracle E-Business Suite (EBS).Progress MOVEit Transfergovernment warned that Snakefly was actively exploiting a newly discovered vulnerability in MOVEit Transfer.ResticNetScan for the discovery of host names and network services, and the publicly available data backup tool Restic for data exfiltration.SalesforceShinyHunters has been involved in data theft and extortion attacks since 2020, but it made headlines in 2025 when it carried out a series of attacks that targeted the Salesforce instances of multiple companies worldwide.SimpleHelpBalloonfly was also reported to have exploited the vulnerability in the remote monitoring and management (RMM) tool SimpleHelp (CVE-2024-57727).SonicWall SSL VPNIn August 2025, it was reported that attackers deploying Akira may have been exploiting a zero-day vulnerability in SonicWall SSL VPN devices.Symantec Data Center SecuritySymantec Data Center Security (DCS) prevents exploitation of known and zero-day vulnerabilities on public-facing webSymantec Endpoint SecurityRecent, independent testing by SE Labs found that both Symantec Endpoint Security Complete and Carbon Black CloudVeeam Backup & ReplicationIn October 2024, users of Veeam Backup & Replication servers were warned that the Akira and Fog ransomware groups were starting to target vulnerable Veeam installations for ransomware attacks.
Tools
ak47c2Another feature of its attacks was the use of a custom command and control (C&C) framework that appeared to be called ak47c2 by the attackers themselves.Cobalt StrikeThis coolschool stolen certificate appears to have been in use as far back as 2022, when it was used to sign Cobalt Strike and BYOVD-related malware uploaded to VirusTotal.EDRKillShifterA tool called EDRKillShifter that was originally developed by Greenbottle is now reportedly being shared by groups including Stinkbug, Blacksuit, Medusa, DragonForce, Crytox, Lynx, and Inc.HRSwordOne of those tools was HRSword.MimikatzMimikatz: By far the most frequently used tool for credential theft is Mimikatz. The tool was created in 2011 and wasnetscanOther tools that have been deployed on victim environments during Inc ransomware attacks include Advanced IP Scanner, NetScan, PuTTY, Cobalt Strike, Lsass, AnyDesk, and AV Killer tools to disable security software.PlusBruteOne recent example was when attackers using the Play ransomware, utilized a tool called PlusBrute to brute-force login onPsExecOther tools used in that attack included AnyDesk, MeshAgent, PsExec, and s5cmd (an open-source S3 and local file system execution tool).RCloneRclone: An open-source tool that can legitimately be used to manage content in the cloud but has been seen being abusedYDarkThe other previously unseen tool, YDark, is a publicly available kernel manipulation tool that can be used to hide running processes.
Countries
BrazilSentinelOne, which calls the group ChamelGang, said it had staged attacks against organizations in the U.S., Brazil, India, Russia, Taiwan, and Japan.ChileIn April 2024, Balloonfly was linked to an attack on IxMetro Powerhost, a major web infrastructure service provider based in Chile.China- [Emergent China Cybercrime Nexus?](#emergent-china-cybercrime-nexus)IndiaSentinelOne, which calls the group ChamelGang, said it had staged attacks against organizations in the U.S., Brazil, India, Russia, Taiwan, and Japan.JapanSentinelOne, which calls the group ChamelGang, said it had staged attacks against organizations in the U.S., Brazil, India, Russia, Taiwan, and Japan.RussiaUnlike many ransomware operations, which are usually headquartered in Russia or other countries in the Commonwealth of Independent States, Warlock appears to be used by a group based in China.TaiwanSentinelOne, which calls the group ChamelGang, said it had staged attacks against organizations in the U.S., Brazil, India, Russia, Taiwan, and Japan.United KingdomIn 2025, it deployed the DragonForce ransomware onto the networks of multiple well-known UK retailers (including Marks & Spencer, Harrods, and supermarket chain Co-op).United StatesShortly after, in June 2023, the U.S. government warned that Snakefly was actively exploiting a newly discovered vulnerability in MOVEit Transfer.
Industries
EngineeringScattered Spider, which, like ShinyHunters, is also known to primarily gain access to victim networks by carrying out sophisticated social engineering attacks.GamblingIn August 2025, the Threat Hunter Team also saw evidence of Akira attackers targeting the gambling industry in the U.S.Governmentgovernment warned that Snakefly was actively exploiting a newly discovered vulnerability in MOVEit Transfer.HealthcareMany attacks were carried out through the year, including high-profile attacks on healthcare organizations and Japanese brewing giant Asahi.InsuranceThe wave of attacks impacted numerous companies, including Google, Farmers Insurance, Allianz Life, Workday, Pandora, Cisco, Chanel, and Qantas.ManufacturingThis appears to be a widespread campaign by the attackers with victims in multiple countries and sectors, including manufacturing, retail, professional services, and more.Professional ServicesThis appears to be a widespread campaign by the attackers with victims in multiple countries and sectors, including manufacturing, retail, professional services, and more.RetailScattered Spider also targeted organizations in the retail and insurance sectors in the U.S.