Threat Actor Focus

Reconnaissance Fuels
4-Minute Breakout

While average breakout time continued to shrink, the most alarming change was how far the fastest breakout times collapsed. Breakout time is the critical window between initial access into a system and lateral movement to another asset. It’s one of the most important metrics for defenders because it defines the opportunity to detect and contain an intrusion before it spreads. Once an attacker gets in—whether through phished credentials, an exploited vulnerability, or a compromised third party—the clock starts.

Measure Twice, Cut Once: Attackers’ Careful Preparation

To ensure the fastest possible breakout, attackers invest significant effort in reconnaissance and preparation, using open-source intelligence (OSINT) to identify and profile high-value users within target organizations and pre-build believable social engineering.

We expect attackers to increasingly leverage AI to accelerate this reconnaissance phase, automating analysis of social media profiles, corporate websites, and other public data sources to craft convincing social engineering scripts, and compress days of manual research into hours or minutes. Without proactive defense, by the time initial access has occurred, attackers already know who to call, what to say, and where to move.

The fastest breakout times we observed happened when social engineering was used for initial access. Groups like Scattered Spider show how extensive reconnaissance directly enables sub-5-minute lateral movement. They identify high-value targets in advance and use the collected personal details to secure privileged access, making “privilege escalation” effectively unnecessary.

The difference in defending an attack before and after breakout is stark. Pre-breakout, defenders are dealing with one compromised system, limited data exposure, and straightforward remediation. Post-breakout, they’re suddenly managing multiple compromised systems, higher odds of attackers gaining domain-wide access, heavier forensic investigations, and significantly higher risk of data exfiltration or encryption. Each additional system an attacker reaches multiplies scope, cost, and complexity.

Organizations have begun to adopt tactics like automated incident response to combat increasingly fast breakout times. GreyMatter customers using Automated Response Playbooks achieved an average containment time of 4 minutes—keeping pace with the fastest breakouts. Without automation, average containment stretched to 16 hours, leaving defenders behind in a race they can’t win.

Ransomware Fractures into a Swarm of Smaller, More Agile Groups

The era of ransomware “giants” is fading. In 2025, we watched as the landscape fragmented into a swarm of smaller, agile groups following law enforcement disruptions. We saw a record total of 84 data-leak sites active in Q3, as affiliates moved freely between programs, keeping a wider variety of RaaS operations viable and active simultaneously. With fewer dominant players setting the norm, the cross-pollination of tactics has increased, targeting is less predictable, and attacks are harder to anticipate.

Fragmentation also drove volume. In 2025, 7,734 organizations were named on ransomware data-leak sites, a 47% increase over 2024. Unless a dominant player emerges to centralize these affiliates, we expect this “swarm” dynamic to continue and drive attack volume even higher as new groups launch unique operations.

Mass Exploitation Defines the Market Leaders

The most successful ransomware groups of 2025 consistently relied on mass vulnerability exploitation for initial access, often paired with automation.

The “Clop” ransomware group best exemplifies this strategy. Known for operating in bursts, the group has repeatedly exploited vulnerabilities in managed file transfer (MFT) systems and struck at scale. Its February MFT campaign fueled a 23% spike in overall ransomware activity in Q1 alone.

In October, Clop pivoted to a different software target. We observed victims receiving extortion emails claiming data theft sent from compromised legitimate accounts within their own organization, helping the group bypass email filters.

While Clop moved in waves, “Qilin” maintained a steady offensive. It was the most active ransomware group in 2025, claiming 387 more victims than its closest competitor, Akira. It listed 188 organizations on its data-leak site in October alone.

Qilin’s dominance can be explained by its business-like operations and aggressive recruitment. Beyond exploiting vulnerabilities (including CVE-2024-55591 and CVE-2024-21762), Qilin also partnered with initial access brokers (IABs) to obtain VPN access, enabling faster, coordinated attacks that bypassed EDRs and avoided noisy exploitation.

Attackers Are Hunting Your Tech Stack

In 2025, ransomware groups focused less on targeting sectors and more on targeting the software platforms that serve them. Attackers increasingly moved upstream, hitting technologies with the potential to unlock entire industries at once.

For example, one Clop campaign set Cleo’s MFT solution in its sights. Thanks to Cleo’s popularity with retailers for managing e-commerce transactions and fulfilling orders, the Clop campaign drove a 153% increase in retail-trade targeting between Q4 2024 and Q1 2025.

We also saw an 84% increase year-over-year in ransomware activity affecting the professional, scientific, and technical services (PSTS) sector. Qilin’s penchant for targeting this sector (accounting for 17% of all organizations named on its data-leak sites) and Akira’s recent SonicWall campaign likely contributed to this spike, as most SonicWall customers are IT services and consulting firms. In the SonicWall campaign, Akira weaponized a single firewall vulnerability to destabilize the companies responsible for securing others.

Geographically, the US remained the primary target due to its revenue potential—but a shift is underway. Countries with rapidly growing digital economies, where infrastructure growth often outpaces cybersecurity maturity, are facing disproportionate targeting. Attackers are aggressively exploiting the gap between fast-expanding digital infrastructure and lagging cybersecurity maturity in these regions.

Based on these trends, we predict 2026 to bring less broad, vertical-based targeting (e.g., health care) and more technology-based targeting (e.g., users of Software X). This shift will mean third-party risk management (TPRM) will be as important as defending your own network for the coming year.

Groups to Watch: The War for Platform Dominance

The RaaS market has become a battle of technology, and automation is almost certainly speeding up ransomware attacks, with 80% of the RaaS groups we analyzed now offering some form of automation or AI features. Platforms built on automation, customization, and advanced tool sets likely attract the most skilled affiliates who can use them to compromise higher-revenue organizations and increase the odds of a successful extortion payment.

Despite being the most active ransomware group in 2024, “LockBit” struggled to recover after law enforcement disruption. The group listed 70% fewer organizations on its data-leak site in 2025. But a weakened player can still be dangerous. In June 2025, LockBit announced “LockBit 5.0,” a platform overhaul designed to win back affiliates. Early efforts to regain dominance fell short, but in December the group resurfaced with a surge in named organizations.

As LockBit stumbled, groups like “The Gentlemen” and “DragonForce” moved to fill the gap by offering more feature-rich platforms with advanced capabilities similar to Qilin. Over the next 12 months, these groups are well positioned to become significant threats.

We expect emerging cybercriminal groups to embrace louder branding campaigns in 2026 to attract affiliates, while more established actors prioritize operational secrecy to avoid law enforcement scrutiny. These contrasting tactics will create prioritization challenges for security teams, potentially leading to operational overload and exposing organizations to stealthier, more dangerous threats

Your Strategy for Combatting
Cybercriminal Activity

Stopping an attacker at initial access makes the difference between straightforward remediation and full-blown compromise. To defend against today’s compressed timelines, organizations need proactive intelligence that identifies exposed information before attackers can use it and agentic AI to autonomously hunt, detect, and analyze threats at the speed required to contain them.

Bogus Applicants: The State-Sponsored Insiders

This year, we investigated North Korean state-sponsored operatives posing as skilled freelancers or contractors to infiltrate Western companies using fake identities. North Korea has allegedly run insider threat programs for years to fund its weapons programs amid US and international sanctions. What’s new this year is the scale: We observed a 116% increase in fraudulent North Korean hires in 2025 compared to 2024. We reviewed thousands of insider-threat applications across our customer base and identified more than 7,000 email addresses belonging to suspicious candidates.

A North Korean insider may seem far-fetched, but it’s a dominant nation-state threat. A successful hire gives a state-sponsored actor immediate access to internal networks that bypass perimeter defenses. And AI is helping these personas look more credible at scale.

Targeting Recruiters with AI-Generated Profiles and Deepfake Interviews

It starts with the hiring process. To get past recruiter screening, operatives build networks of fake social media profiles to create a convincing backstory. These profiles, complete with legitimate-looking work histories and communications, are almost entirely AI-generated, helping operatives overcome language barriers. But even with the AI assist, the profiles are often littered with red flags: low activity, implausible experience, and overly polished skill lists.

When applying to foreign organizations, North Korean operatives face another problem at the interview stage—they can’t show up in-person. To work around it, they target remote-friendly freelancer and contractor roles, often in technology-related companies.

* Figure 8: AI generated LinkedIn Profile

When recruiters engage with these profiles, the operatives avoid face-to-face interaction for as long as possible. If an interview requires video, some operatives use deepfake technology to pass initial screenings without exposure.

Once they land the job, operatives weaponize onboarding and “IT troubleshooting” to establish persistent remote access, often by persuading hiring teams to install remote-access tools like AnyDesk.

This step is critical because it connects corporate laptops to their “laptop farms,” remote locations that house multiple devices, enabling full network access even before they’re fully onboarded. This allows the operatives to map the network and exfiltrate data even if the HR process later falls through.

A Day in the Life of a North Korean Insider

As for the operatives’ day-to-day, our data indicates a factory-like operating model where operatives trade shifts to maintain productivity. This means organizations aren't hiring 1 freelancer, they’re effectively hiring a seat in a state-run facility where multiple operators work under a single "employee" persona to keep access and output high.

To maintain this façade, operatives use industrial-scale infrastructure like commercial VPNs (such as Astrill) to hide their true location, but their operational security isn’t perfect. When a VPN drops or they forget to activate it, the mask slips.

Our investigations revealed this slip clearly when we observed IP addresses belonging to Russian and Chinese internet service providers (ISPs) in remote management and monitoring (RMM) activity. This suggests North Korean insiders rely on RMM sessions to access devices in laptop farms and are authenticating from their own territory before routing traffic through US nodes.

In some cases, activity linked to both ISPs appeared within a short timeframe for the same user. This indicates either one worker using both ISPs or multiple attackers all sharing a single “employee” identity to pull off the deception.

Once an organization is flagged as viable (likely due to gaps in their hiring process), the regime swarms it with candidates. We found multiple insiders authenticating from the same fixed-line IP address, and in one extreme case, a single company identified 10 separate North Korean insiders in a rolling wave of infiltration attempts over just 6 months.

We also observed VPS IP addresses tracing back to Russia and the US that weren’t associated with commercial VPN providers. We found open ports on these endpoints containing AnyDesk certificates, suggesting RMM tool abuse to facilitate remote control. Attackers are moving away from easily blacklisted commercial VPNs toward custom, private infrastructure. By routing traffic through US-based VPS nodes, operatives can bypass standard geo-blocking policies and appear to be working from within the US.

For defenders, a single anomalous location or remote-access indicator may be the only visible thread that can unravel an entire network of insider threats.

Bypassing Defenses with Commercial IP-KVM Hardware

When software-based stealth isn’t enough, operatives turn to hardware. IP-KVM devices are low-cost, customizable solutions that provide remote access to a computer’s console (keyboard, video, mouse) over the internet.

Their superpower is that they operate externally. Because the device acts as a physical peripheral plugged into USB and HDMI ports, it bypasses standard EDR agents. To the operating system, the malicious remote control looks identical to a legitimate employee sitting at their desk, typing on a wired keyboard.

However, the invisibility isn’t perfect. Even stealthy IP-KVMs leave behind artifacts, but detecting them requires granular device monitoring that many security teams don’t have. This is one reason why North Korean workers prefer environments where endpoint visibility is limited, such as those with BYOD policies, where monitoring may be constrained by policy or privacy.

Chinese APTs Play the Long Game

For most cybercriminals, success is measured by speed (i.e., how fast can we encrypt?). For Chinese state-sponsored actors, success is an exercise in patience.

This persistence focus is reflected in the timelines as attackers move slowly, blend in, and collect intelligence over time. In 2025 customer incidents, we observed China-linked activity with breakout times of 20-plus hours and year-long persistent access.

As the attackers’ tactics shift, so must the defenders’. Instead of relying on rapid detection to combat these threats, analysts must lean on correlating data across technologies to surface subtle anomalies.

The Fight to Remain Inside the Network

A defining characteristic of the China-linked attacks we investigated this year was resilience. Because these actors prioritize deep persistence, a standard remediation is often just a temporary disruption to their operations rather than complete removal. We’ve seen the full spectrum of modern espionage tradecraft and technical expertise in our incidents, including the ability to re-compromise a network after being removed.

In one case, the adversary gained initial access by exploiting multiple SharePoint vulnerabilities before brute-forcing several service accounts. Their goal was to reach a Secure File Transfer Protocol (SFTP) server holding sensitive configuration data and then disappear into normal activity. To achieve this, the adversary created files designed to impersonate legitimate files, which established a persistent backdoor that looked identical to standard business traffic.

To stay hidden, the attacker relied on sustained defense evasion. They hijacked legitimate binaries to execute malicious payloads, signing them with old but valid certificates to bypass security controls. They also ran in-memory scripts via Windows Management Instrumentation (WMI) to evade endpoint detection and wiped AD driver logs to reduce visibility into authentication activity.

The Shift from Custom Malware to LotL

For years, detecting China-linked activity meant finding custom malware families (such as the notorious “PlugX”). But in late 2025, we observed a strategic pivot away from custom tools to LotL techniques, where attackers repurposed legitimate system components instead of dropping obvious malicious files. This approach lets attackers become invisible to traditional antivirus signatures. Worse, they’re also weaponizing the organization's own disaster recovery plans against them.

In one attack we investigated, the Chinese APT group Flax Typhoon maintained persistence for over a year by modifying a Java server object extension (SOE) into a functioning web shell. Access was gated behind a hardcoded key for exclusive control, and the compromised component was embedded in system backups, so full system recovery would restore the backdoor and enable reinfection. The attack exploited trust in legitimate software components, a common security blind spot that allowed Flax Typhoon’s movements to appear as normal system operations and bypass detection tools.

The primary goal of this attack was credential harvesting. The group targeted the workstations of two IT staff and attempted to enable Remote Registry to access system configuration data, with activity consistent with efforts to dump the Security Account Manager (SAM) database, security registry keys, and Local Security Authority (LSA) secrets to obtain the credentials needed to deepen their foothold in the network.

Your Strategy for Combatting Nation-State Groups

Nation-state actors succeed through persistence and stealth or by staying ahead of evolving APT persistence mechanisms. Enterprises need defense in depth that pairs behavior-based detections (to catch what signatures miss) with proactive threat hunting that surfaces persistence, credential harvesting, and anomalous privileged activity.