INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Lazarus Group Exploits Zero-Day in Microsoft Office

| 2025-12-23 13:00 CRITICAL LOW RANSOMWARE & EXTORTION DATA BREACH
JSON
Executive Summary
AI-generated
In 2025, a significant number of ransomware attacks occurred globally, with the US being the primary target country for victims, accounting for almost half of the total listed victims at approximately 3328. The Russian-linked ransomware group Clop was particularly active in the first quarter of 2025 before slowing down during the summer months until October, when a small peak of activity occurred. Ransomware groups targeted various industries, including manufacturing (930 victims), technology (893 victims), and healthcare (529 victims). Meanwhile, less organized collectives such as Scattered Spider, Lapsus$, and ShinyHunters gained notoriety in 2025, while traditional ransomware syndicates continued to be active throughout the year.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 1 IoCs Create Free Account
ra•••••.live
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Scattered SpiderScattered Spider QilinQilin
Target & Sectors
DACH DACH NORTH_AMERICA NORTH_AMERICA manufacturingmanufacturing
Incident Timeline
‎2025/12/23
Ransomware groups claimed 7902 victims in the United States, accounting for almost half of total ransomware group-listed victims worldwide.
victims 10 sectorial categories
US Ransomware Victims Made Half of 2025’s Total In 2025, ransomware groups targeted a wide range of industries, with Ransomware.live reporting victims for at least 10 sectorial categories.
financial 973 Ransomware.live
Qilin, the group that  claimed the cyber-attack on brewing giant Asahi  in September, was  the most prolific ransomware group , with 1001 victims listed on its data leak site according to Ransomware.live and 973 according to competitor RansomLook.
victims 358 listed victims
The second most targeted country, Canada, represented a far lower number with 358 listed victims over the past year.
victims 930 manufacturing sector
The highest number of victims came from the manufacturing sector (930), followed by technology (893) and healthcare (529).
threat_actor Scattered Spider
Additionally, less organized collectives such as Scattered Spider, Lapsus$ and ShinyHunters grabbed many of the headlines in 2025.
victims 5336 victims
This is significantly higher than the 6129 victims listed in 2024 and the 5336 victims listed in 2023.
Tactical Metrics
Metrics
victims
10
Sectorial Categories
US Ransomware Victims Made Half of 2025’s Total In 2025, ransomware groups targeted a wide range of industries, with Ransomware.live reporting victims for at least 10 sectorial categories.
Metrics
victims
358
Listed Victims
The second most targeted country, Canada, represented a far lower number with 358 listed victims over the past year.
Metrics
victims
930
Manufacturing Sector
The highest number of victims came from the manufacturing sector (930), followed by technology (893) and healthcare (529).
Metrics
financial
973
Ransomware.Live
Qilin, the group that  claimed the cyber-attack on brewing giant Asahi  in September, was  the most prolific ransomware group , with 1001 victims listed on its data leak site according to Ransomware.live and 973 according to competitor RansomLook.
Metrics
victims
5,336
Victims
This is significantly higher than the 6129 victims listed in 2024 and the 5336 victims listed in 2023.
Intelligence Sources
Infosecurity-Magazine 2025-12-23
Top Ransomware Trends of 2025 Infosecurity-Magazine