Inside 2025’s Top Threat Groups: Why Familiar Actors Still Have the Upper Hand
None
<p><span data-contrast="auto">As cyberattackers evolve at a pace defenders can’t match, </span><a href="https://www.extrahop.com/global-threat-landscape-2025" target="_blank" rel="noopener"><span data-contrast="none">new research</span></a><span data-contrast="auto"> uncovers the threat groups behind <a href="https://securityboulevard.com/2025/12/recent-cyber-attacks-and-threat-actor-activity-a-deep-dive-into-the-evolving-threat-landscape-2/" target="_blank" rel="noopener">today’s most destructive incidents</a> and the organizational weaknesses keeping security teams a step behind.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">Over the past year, we’ve seen tremendous growth in ransomware activity from some of the world’s leading groups, including RansomHub, LockBit, DarkSide, APT41, and Black Basta.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">For the most part, these groups also rely on older tactics to gain access. Phishing remains the top gateway to entry, while other common tactics include social engineering, software exploitation, and stolen credentials. Despite many of these attack tactics looking familiar year after year, organizations still find themselves reacting from a position of disadvantage – constantly starting on the back foot.</span><span data-ccp-props="{}"> </span></p><h3><b><span data-contrast="auto">Why Defenders are Still Falling Behind</span></b><span data-ccp-props="{}"> </span></h3><p><span data-contrast="auto">If 2025 made one thing clear, it’s that defenders are falling behind due to complexity. Many organizations still rely on legacy tools, which create blind spots for attackers to jump on. Limited visibility was the top barrier that security teams face, among skills gaps, alert fatigue, and siloed tools. Moreover, the biggest vulnerabilities were seen in everyday operational blind spots. Areas including public cloud exposure, third-party integrations, and across generative AI applications lack the most in visibility. </span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">The lack of visibility directly impacts an organization’s response time. On average, organizations took two weeks to respond to and contain a security alert. That’s the same amount of time (and if not, longer) that attackers spent dwelling inside networks before being detected. In government networks specifically, that window reached a staggering seven weeks on average, allowing attackers ample time to move laterally between systems and devices to exfiltrate data.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">The financial consequences are growing just as rapidly, with the average ransom payout reaching $3.6 million in comparison to 2024’s average of $2.5 million. This upward trend shows that attackers are continuing to gain a high return on investment – targeting the right organizations with the right amount of impact.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">Their success is largely because these groups increasingly operate like sophisticated businesses. Support from affiliate networks is making them more powerful, while many groups deploy AI to help scale operations, create more convincing phishing lures, and evade detection.</span><span data-ccp-props="{}"> </span></p><h3><b><span data-contrast="auto">A Deep Dive into 2025’s Most Notorious Threat Groups</span></b><span data-ccp-props="{}"> </span></h3><p><span data-contrast="auto">LockBit, DarkSide and Black Basta were among several high-profile groups with a key focus on government agencies. This sector suffered some of the most severe impacts, including ransom payouts nearing $7.5 million on average, making it one of the top vertical victims.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">RansomHub and DarkSide also maintained a wider focus across industries. Their attacks increasingly focused on ransomware with data extortion, seeking sensitive files before encryption to improve their leverage.</span><span data-ccp-props="{}"> </span></p><p><a href="https://cybersecuritynews.com/new-analysis-uncovers-lockbit-5-0-key-capabilities/" target="_blank" rel="noopener"><span data-contrast="none">LockBit 5.0</span></a><span data-contrast="auto">’s emergence in September was a key example of the group’s increasing sophistication. Attackers quickly redeveloped following major global takedown actions and expanded their targeting capabilities, such as by advancing its Linux encryptors. Given its persistence and adaptability, LockBit remains one of the most dangerous ransomware-as-a-service (RaaS) groups globally.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">APT41 was tied to a</span><a href="https://thehackernews.com/2025/09/china-linked-apt41-hackers-target-us.html"><span data-contrast="auto"> </span></a><a href="https://thehackernews.com/2025/09/china-linked-apt41-hackers-target-us.html" target="_blank" rel="noopener"><span data-contrast="none">phishing campaign</span></a><span data-contrast="auto"> earlier this year, impersonating U.S. Representative John Moolenaar. Targeting trade groups, government agencies, and law firms, the group shows us how phishing remains an effective and dangerous method, and is especially concerning when the end goal is compromising credentials from political leaders.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">Finally, Black Basta was linked to</span><a href="https://techcrunch.com/2024/12/20/ransomware-attack-on-health-giant-ascension-hits-5-6-million-patients/"><span data-contrast="auto"> </span></a><a href="https://techcrunch.com/2024/12/20/ransomware-attack-on-health-giant-ascension-hits-5-6-million-patients/" target="_blank" rel="noopener"><span data-contrast="none">hundreds of attacks</span></a><span data-contrast="auto">, including the 2024 attack on Ascension, which affected over 5 million patients. Making headlines, the incident shows the group’s willingness to disrupt services across both critical infrastructure and the public sector for financial gain.</span><span data-ccp-props="{}"> </span></p><h3><b><span data-contrast="auto">Security Teams can Regain the Advantage</span></b><span data-ccp-props="{}"> </span></h3><p><span data-contrast="auto">Relying on reactive measures is no longer sufficient and organizations will continue to fall behind without the right visibility, proactive threat hunting, and detection and response capabilities.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">Following today’s top threat actors and how they operate is key. The better threat intelligence you have, the better you can focus on the most critical vulnerabilities and plan proactively. Security leaders must prioritize three essential areas to remain agile.</span><span data-ccp-props="{}"> </span></p><ul><li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="1" data-list-defn-props='{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"multilevel"}' data-aria-posinset="1" data-aria-level="1"><b><span data-contrast="auto">Understand your attack surface:</span></b><span data-contrast="auto"> Tackle complexity by addressing redundant or siloed tools, knowing where your assets are, and patching vulnerable legacy infrastructure.</span><span data-ccp-props="{}"> </span></li></ul><ul><li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="1" data-list-defn-props='{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"multilevel"}' data-aria-posinset="2" data-aria-level="1"><b><span data-contrast="auto">Improve your visibility: </span></b><span data-contrast="auto">Listen to your network traffic. As many modern attacks bypass the perimeter and move laterally within large, enterprise networks, keeping tabs on that traffic helps SOCs identify malicious activity before it becomes a bigger problem.</span><span data-ccp-props="{}"> </span></li></ul><ul><li aria-setsize="-1" data-leveltext="●" data-font="" data-listid="1" data-list-defn-props='{"335552541":1,"335559685":720,"335559991":360,"469769242":[8226],"469777803":"left","469777804":"●","469777815":"multilevel"}' data-aria-posinset="3" data-aria-level="1"><b><span data-contrast="auto">Stay ahead of evolving threats:</span></b><span data-contrast="auto"> Threat groups are adopting tools like generative AI, leaning into full disruption, and hitting both public and private infrastructure. Understand their tactics and prepare to defend against them.</span><span data-ccp-props="{}"> </span></li></ul><h3><b><span data-contrast="auto">A Constantly Shifting Battlefield</span></b><span data-ccp-props="{}"> </span></h3><p><span data-contrast="auto">2025 has shown us how dynamic today’s threat landscape is, especially as AI-driven attacks continue to escalate. Success in defenses in the coming years relies on visibility, speed, and preparedness on the basics.</span><span data-ccp-props="{}"> </span></p><p><span data-contrast="auto">As threat groups become more sophisticated, organizations with a proactive strategy and tools will gain the upper hand. Those who remain agile to changes will be the real leaders in the future of cyber resilience.</span><span data-ccp-props="{}"> </span></p><div class="spu-placeholder" style="display:none"></div><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_20 addtoany_list" data-a2a-url="https://securityboulevard.com/2026/01/inside-2025s-top-threat-groups-why-familiar-actors-still-have-the-upper-hand/" data-a2a-title="Inside 2025’s Top Threat Groups: Why Familiar Actors Still Have the Upper Hand "><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Finside-2025s-top-threat-groups-why-familiar-actors-still-have-the-upper-hand%2F&linkname=Inside%202025%E2%80%99s%20Top%20Threat%20Groups%3A%20Why%20Familiar%20Actors%20Still%20Have%20the%20Upper%20Hand%C2%A0" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Finside-2025s-top-threat-groups-why-familiar-actors-still-have-the-upper-hand%2F&linkname=Inside%202025%E2%80%99s%20Top%20Threat%20Groups%3A%20Why%20Familiar%20Actors%20Still%20Have%20the%20Upper%20Hand%C2%A0" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Finside-2025s-top-threat-groups-why-familiar-actors-still-have-the-upper-hand%2F&linkname=Inside%202025%E2%80%99s%20Top%20Threat%20Groups%3A%20Why%20Familiar%20Actors%20Still%20Have%20the%20Upper%20Hand%C2%A0" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_reddit" href="https://www.addtoany.com/add_to/reddit?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Finside-2025s-top-threat-groups-why-familiar-actors-still-have-the-upper-hand%2F&linkname=Inside%202025%E2%80%99s%20Top%20Threat%20Groups%3A%20Why%20Familiar%20Actors%20Still%20Have%20the%20Upper%20Hand%C2%A0" title="Reddit" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fsecurityboulevard.com%2F2026%2F01%2Finside-2025s-top-threat-groups-why-familiar-actors-still-have-the-upper-hand%2F&linkname=Inside%202025%E2%80%99s%20Top%20Threat%20Groups%3A%20Why%20Familiar%20Actors%20Still%20Have%20the%20Upper%20Hand%C2%A0" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div>