2025年勒索软件概览

Disclaimer:This report has been prepared by S2GRUPO forinformation and professional purposes. Its content is protectedby intellectual property rights and reflects the company’s analysisand expert knowledge of the ransomware landscape. Its reading Executive In a context of growing geopolitical instability, technologicaltension and accelerated threat evolution,ransomwarehasconsolidated its roleas a key tool for disruption and extortion incyberspace.What began as an opportunistic criminal technique This report, prepared byS2GRUPO’s LAB52 team, analyses themain active ransomware groups, their recent evolution, emergingtactics, as well as the most affected sectors and regions. It alsoprovides a critical reading on IT/OT convergence and its impact Beyond the technical compilation, the document provideskeysfor anticipation and responsewith a comprehensive approach:from geopolitical analysis and the evolution of the Ransomware-as-a-Service (RaaS) model, to the necessary capabilities to resist, We hope this report will help decision-makers better understandthe risk, identify relevant trends and strengthen their cyber Table of Contents 1. Strategic overview of ransomware6 1.1. Introduction: Ransomware as a structural threat1.2. Emerging risks in industrial environments1.3.Conclusion of the block61011 2. 2024 - The fall and rise of new groups12 3.1. Ransomware during 2025 first quarter3.2. Changes during April 20253.3. Countries with the highest number of victims3.4. Most affected sectors and Operational Technology (OT)43464752 5. Conclusions67 Strategicoverview ofransomware BLOCK 1 Introduction:Ransomware as a1.1 Ransomwarerepresents one of the mostserious and widespreadcyber threats of the digital age, affecting both individuals andorganisations of all sizes and sectors. This report, as in previous Indeed,geopolitical eventscan have a direct impact on the rise ofransomware attacks.Cyberattackshave become acommon toolof hybrid warfare, a continuation of conflict by other, less directmeans, in this case, cyber. Ransomware groups need not directly Ransomware-- a type of malware that prevents access tothe affected system’s data, usually by means of encryptionalgorithms. The actors behind this type of attack usually The sophistication of ransomware campaigns has evolveddramatically, no longer just random attacks, buttargetedoperationsusing advanced social engineering techniques,exploitation of unpatched vulnerabilities andlateral movementwithin corporate networks. As indicated in previous reports on the For example, theRussian group (APT44)has used ransomwarenot for ransom, but as a means to destroy data intargeted attacksagainst critical infrastructure in Ukraine and Poland, in supportof Russia’s war efforts3. In the case of North Korea, groups suchasMoonstone Sleethave deployed custom ransomware, suchas FakePenny, with the aim ofstealing sensitive informationand generating illicit revenues that fund state activities. It is These and other APT groups often haveample resources, timeand capabilitiesto carry out highly targeted and coordinatedattacks, leveraging their access tocritical infrastructureto In turn,ransomware groups- and more specifically thoseoperating under theRansomware as a Service (RaaS)model -have been able to learn from the malware available through publicsources or through information leaks from more advanced groups,to improve their offensive capabilities. All this, together with tools Ransomware as a Service- a model in which cybercriminalsrent ransomware to other actors in exchange for a share of theransom, or some other type of agreement between the parties The damage of a successful attack goes far beyond data leakage,it can involve thecomplete shutdown of critical operations, lossof revenue, reputational damageandpersonal data breaches.In addition, a trend already noted through previous reports is thatmodern variants not only encrypt files, but alsosteal informationbefore doing so, adding an additional layer of extortion: the threat Emerging risksin industrial1.2 Of particular concern areattacks affecting the industrialsector, andcritical infrastructurein particular. In recent years,ransomware attacks have evolved significantly from being threatsdirected exclusively at the IT environment to becoming a directand critical threat toOperational Technology (OT)environments. Despite the efforts of authorities and the cybersecurity communityto prevent and mitigate these attacks, ransomware also thrives ontheanonymity afforded by cryptocurrenciesand thedifficulty Conclusion of theblock1.3 Ransomwarecan no longer be addressed as a meretechnical problem, but has become astructural challengeof national security, organisational resilience andeconomic stability.Combating this threat requires a But, above all, it requires athorough understanding of itsevolution inorder to anticipate its next moves and contain The fall andrise of new BLOCK 2 Reconfiguringthe criminal2.1 Theransomw