Group-IB, a leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime, announced today the launch of its highly anticipated High-Tech Crime Trends Report 2025, offering a comprehensive analysis of the evolving cyber threat landscape. The report highlights how state-sponsored espionage, ransomware, underground marketplaces, and AI-driven cybercrime are feeding into one another, creating a self-sustaining cycle of digital threats.
Unravelling the Web of Cybercrime
The proliferation of Advanced Persistent Threats (APTs) has intensified global cyber risks, with a 58% increase in APT-attributed attacks recorded in 2024. In Europe, APT28 and Gamaredon focused on government, energy, and military sectors amid geopolitical tensions. The Middle East & Africa saw increased activity from the likes of OilRig and MuddyWater, targeting financial services and energy. Asia-Pacific faced threats from APT10, which attacked IT and manufacturing, while the notorious Lazarus Group intensified cryptocurrency theft, and DarkPink infiltrated government and military networks. North America was targeted by Dark Halo, which launched cyber espionage campaigns against IT, financial services, and defense sectors. In Latin America, APT10 expanded operations in Brazil, attacking telecommunications and financial institutions.
The intelligence and access gained through APT campaigns frequently serve as an entry point for broader cybercriminal activities. Initial Access Brokers (IABs), whose operations increased by 15% in 2024, facilitate this transition by selling compromised network access to the highest bidder. These illicit transactions often serve ransomware groups, financially motivated threat actors, and other criminal enterprises, allowing them to circumvent traditional security perimeters and escalate their attacks more efficiently.
This growing reliance on IABs has contributed to the expansion of ransomware operations, which remain among the most lucrative forms of cybercrime. Ransomware attacks increased by 10% in 2024, fueled by the Ransomware-as-a-Service (RaaS) model. Group-IB recorded a 44% rise in underground recruitment efforts for ransomware affiliates, demonstrating the industrialization of cyber extortion. In 2024 alone, 5,066 ransomware incidents resulted in data leaks on Dedicated Leak Sites (DLS), underscoring the widespread impact of these attacks on businesses and institutions worldwide.
The ramifications of ransomware extend beyond financial extortion. Data breaches and leaks, which saw 6.4 billion compromised records in 2024, have flooded cybercriminal marketplaces with sensitive information. Credentials, email addresses, and financial data are readily available for exploitation, further fueling cyber fraud, identity theft, and secondary attacks. The accessibility of such information has contributed to a surge in phishing attacks, which increased by 22% in 2024. Cybercriminals are now leveraging AI-generated deepfake technology to enhance the credibility of their phishing campaigns, making traditional detection mechanisms increasingly ineffective.
In parallel, hacktivist groups have escalated their cyber operations, often exploiting security vulnerabilities exposed by broader cybercriminal activity. Throughout 2024, politically motivated cyber actors engaged in Distributed Denial-of-Service (DDoS) attacks, website defacements, and large-scale data leaks, targeting entities aligned with geopolitical adversaries. India, in particular, emerged as a primary target, as its diplomatic stance on international conflicts provoked retaliatory cyber campaigns from various hacktivist factions.
“The High Tech Crime Trends report illustrates that cybercrime is not a series of random incidents—it is a chain reaction where each attack strengthens the next. Geopolitics is destabilized by espionage, which is fueled by data breaches, while at the same time ransomware exploits these breaches, all contributing to an ever-growing cyber threat landscape. Organizations must adopt proactive security strategies, fortify cyber resilience, and recognize that every cyber threat feeds into a larger, interconnected battle. To mitigate these threats, we must disrupt the cycle by enhancing cooperation and building a global framework to fight against cybercrime.”
CEO of Group-IB
To gain further insight into these findings, the full High-Tech Crime Trends 2025 report is available here.
