Ransomware groups continue to cause havoc, despite disruptions

Tahawul Tech

12-05-2025

Kaspersky experts have reported a significant rise in targeted ransomware activity at GISEC Global 2025, with the number of active ransomware groups increasing by 35% between 2023 and 2024 – reaching 81 groups globally.
Despite this surge, the number of infected victims dropped by 8% during the same period, reaching an estimated 4,300 victims worldwide. The UAE, South Africa, Saudi Arabia, and Türkiye emerged as the most frequently targeted countries in the region.
According to Kaspersky research of data leak sites of targeted ransomware groups, the number of ransomware groups continued to rise for the second consecutive year, despite two major disruptions targeting LockBit and BlackCat in 2024 – indicating that such attacks remain highly lucrative for cybercriminals.
Targeted ransomware groups use techniques such as exploiting vulnerable internet-exposed services, social engineering, and leveraging traded initial access on the dark web to infiltrate victims. There is also growing evidence also suggests increased collaboration among these groups, including the exchange of malware and hacking tools to achieve their objectives.
His Excellency Dr. Mohamed Al Kuwaiti, Head of Cybersecurity for the UAE Government, affirmed: 'In light of the accelerating pace of cyberattacks globally, it has become imperative to adopt proactive policies that leverage artificial intelligence and advanced analytics to detect threats and respond to them effectively'. He emphasised the importance of GISEC Global 2025 at this critical time and its role in bringing together cybersecurity experts, specialists, and leaders to showcase and discuss evolving threats. The event serves as a vital platform for enhancing collaboration and developing innovative, forward-looking solutions to ensure a secure cyber environment that supports sustainable development and the digital economy.
Maher Yamout, Lead Security Researcher for the Middle East, Türkiye and Africa at Kaspersky, suggest some plans to protect institutions. He said: 'By identifying and securing your corporate network's entry points and understanding the tactics used by ransomware groups, companies can better protect their digital assets against targeted ransomware attacks. Failing to address both aspects, significantly increases a company's vulnerability'.
To help organizations strengthen their defences, Kaspersky recommends the following:
Employee education and cybersecurity training is necessary as human error is a common cause for cybersecurity breach and can serve as an initial point of access for ransomware attacks.
The Kaspersky Threat Intelligence is an essential tool which provides in-depth threat intelligence and real-time insights on the history, motivations and operations of targeted ransomware groups. In addition, Kaspersky's Digital Footprint Intelligence monitors external threats for companies' assets in Surface, Deep and Dark web, strengthening defence against credential leaks.
Keep all devices and systems updated to prevent attackers from exploiting known vulnerabilities.
Set up offline backups that intruders cannot misuse, and make sure you can access it quickly in an emergency.
Kaspersky's multi-layered, next generation protection detects ransomware at both the delivery stage and execution stage of the attack. Kaspersky Next , which combines exploit prevention, behaviour-based detection, and a powerful remediation engine capable of rolling back malicious actions. It also features built-in self-defence mechanisms to prevent tampering or removal by attackers.
Image Credit: Kaspersky