TAMPA, Fla. – Quorum Cyber, a proactive, threat-led cybersecurity company founded to help organizations defend themselves in an increasingly hostile digital landscape, today released its Relentless Threats: 2025 Mid-Year Global Cyber Risk Outlook Report.
Compiled by Quorum Cyber’s Threat Intelligence team, with insights derived from its frontline engagements and strategic monitoring over the first half of the year, the report highlights the tracking of over 70 cybercriminal groups and Malware-as-a-Service (MaaS) offerings, unveiling sophisticated new tactics shaping the cyber threat landscape. It also includes a ransomware demand trend for Q1 2022 to Q1 2025 inclusive.
What You’ll Learn from Quorum Cyber’s 2025 Mid-Year Global Cyber Risk Outlook
Report:
- Rising Ransomware Threats: The ransomware group Codefinger has begun exploiting legitimate Amazon Web Services (AWS) features to encrypt cloud storage, marking a troubling trend toward targeting cloud-native infrastructure
- Emergence of New Stealware: Following law enforcement crackdowns, a new variant known as Acreed has emerged, highlighting the underground market’s resilience
- State and Criminal Convergence: North Korea’s Moonstone Sleet exemplifies the growing convergence of state and criminal capabilities, utilizing a Russian-language Ransomware-as-a-Service (RaaS) platform to target software companies
- Quadruple Extortion Tactics: Groups like Qilin and DragonForce are innovating extortion methods by incorporating services such as legal harassment, AI-driven negotiation bots, and call centers, signaling the rise of ‘quadruple extortion’ in ransomware operations
- Mature RaaS Ecosystem: The RaaS model has evolved towards greater maturity and scalability, adopting enterprise business strategies. A newly discovered whitelabel model allows cybercriminal affiliates to rebrand ransomware payloads, customizing attacks for specific targets
- Increased Ransom Demands: The report reveals a 53% rise in ransom demands from Q1 2022 to Q1 2025, varying across sectors based on financial size and threat actor behaviors
- Actionable Recommendations: understand how to defend against evolving cyber threats, including ransomware and stealware.
“What we’ve seen in H1 2025 is both striking and sobering. The sheer volume of new entrants, more than 70 new threat groups and MaaS offerings, highlights the unyielding pace of cybercriminal innovation,” says Paul Caiazzo, Quorum Cyber’s Chief Threat Officer. “As we move into the latter half of 2025, we anticipate further innovation in social engineering, extortion tactics, and cloud abuse. We also expect greater regulatory and legal entanglements as the lines between sanctioned actors and criminal affiliates blur.”
2025 Mid-Year Intelligence Briefing
Quorum Cyber recently hosted a webinar to explain the key findings of the report and shared actionable advice so that organizations in any sector can counter the growing threats and minimize the risk of becoming the victim of a cyber-attack. You can watch Relentless Threats: 2025 Mid-Year Intelligence Briefing on-demand for free at any time.
About Quorum Cyber
Founded in Edinburgh in 2016, Quorum Cyber is one of the fastest-growing cyber security companies in North America and the UK with over 400 customers on four continents. Its mission is to help good people win and it does this by defending teams and organizations across the world and all industry sectors against the rising threat of cyber-attacks, enabling them to thrive in an increasingly hostile, unpredictable, and fast-changing digital landscape. Quorum Cyber is a Microsoft Solutions Partner for Security, a member of the Microsoft Intelligent Security Association (MISA), and the 2025 Microsoft Security MSSP of the Year. For more information, please visit www.quorumcyber.com or contact info@quorumcyber.com.
