Vampire Cosplay and Brand Revival: Ransomware in 2025

Ransomware-tracking experts say the number of organizations hit with crypto-locking malware appears to be on the rise.

See Also: 2025 Cyber Resilience Checklist

Big, established players are a key part of this first quarter surge: RansomHub listed 87 victims in February, Akira with 77 and Play with 43, a report from consultancy NCC Group said.

Another group claiming numerous victims of late is Clop – aka Cl0p – thanks to its supply-chain attack last December against users of managed file-transfer software built by Cleo Communications. Clop has been extorting victims since it stole their data and threatened to leak it. It has publicly named nearly 400 organizations who declined to pay a ransom.

“Alongside the spike in the release of victims breached in previous months, Cl0p may also exaggerate its own claim to garner attention,” NCC Group’s report said. “Cl0p’s number of attacks should be considered carefully.”

At the same time, new groups continue to emerge. Across 2024, cybersecurity firm BlackFog counted 48 new groups, although how many were renamed or rebooted groups that already existed isn’t clear.

VanHelsing at Large

One newcomer is VanHelsing, a ransomware-as-a-service operation borrows its name from the vampire-hunting character introduced by Bram Stoker in his 1897 gothic novel Dracula.

Check Point Research said the operation launched March 7, and since then it’s seen two Windows-targeting variants of the ransomware compiled five days apart, demonstrating a rapid increase in functionality. The group also claimed to offer variants for infecting Linux, BSD, ARM and ESXi systems. Researchers have confirmed successful attacks against three organizations, with one of the initial ransom demands totaling $500,000 in cryptocurrency.

As with most types of ransomware, VanHelsing’s crypto-locking malware is designed to check where a system is located, and to not encrypt any system operating from Russia or other Commonwealth of Independent States. Files encrypted by its ransomware operation get the extension .vanhelsing added to their name.

The operation’s known victims so far have been located in France and United States, and hail from the government, manufacturing and pharmaceutical sectors, said cybersecurity threat management firm Cyfirma. Most ransomware attacks are opportunistic.

If any VanHelshing victim paid extortion- and what amount – isn’t clear. Experts and law enforcement officials urge victims to never pay a ransom – but if they do, to never pay for abstract promises such as data deletion, since there’s no evidence such a promise has ever been honored.

Ransomware groups recruit the best and brightest in criminal hacking talent to make as much money as possible in the least amount of time, and that’s the case for VanHelsing too. “Reputable affiliates can join for free, while new affiliates must pay a $5,000 deposit to gain access to the program,” payable in cryptocurrency, Check Point said.

LockBit 4.0 Recruits Affiliates

While new groups continue to debut, others sometimes appear to come back from near-death, although who’s in charge may remain a mystery.

This describes LockBit, which was infiltrated and disrupted in early 2024 by an international law enforcement consortium as part of an ongoing effort dubbed Operation Cronos. The effort has included authorities naming the group’s leader “LockBitSupp” as Russian national Dmitry Yuryevich Khoroshev and posting a large reward for his arrest, as well as this month extraditing from Israel an accused developer for the group to stand trial in the U.S.

A darknet post last December announced that the LockBit brand will nonetheless continue, and previewed the launch of version 4.0 of its malware on Feb. 3 for any would-be affiliate who wanted to sign up by linking their Bitcoin or Monero wallet to its portal.

Researchers at cybersecurity firm Deep Instinct said the launch went as planned and they’ve obtained copies of the malware, as well as access to a portal the group built for affiliates, designed in part to enable them to handle victim negotiations.

“The platform features new .onion domains which are attached to ransom notes and open chat support between the hackers and their targets,” it said. “After opening the link, victims are asked to enter the ‘Decryption ID’ they received in their ransom note to verify their details.” The researchers said the portal tells victims they can upload up to three encrypted files to test whether or not they can be decrypted, functionality LockBit previously offered.

Overall, the new version – apparently based on the old – “introduces many new features focused on evading security products, but it also takes a few steps back from LockBit 3.0, including switching to a simpler packer, not removing Microsoft Defender and encrypting more slowly,” researchers said.

Whether or not affiliates buy into the latest version of LockBit remains to be seen, not least because the operation previously attempted to differentiate itself from other offerings based on the speed and sophistication of its offerings. Also, getting infiltrated and disrupted by law enforcement may not be good for recruitment.

Top Groups Innovate

Competition for recruiting the best affiliates is fierce. Cybersecurity consultancy S-RM said high-flier Akira accounted for 15% of the incidents it investigated in 2024. The group maintained its position in part thanks to the sophisticated hackers it recruits, who often bring a very particular set of skills for getting the job done.

S-RM described this recent Akira outbreak it investigated: an attacker gained remote access to a victim’s network via one of its remote-access tools, and attempted to push a zip-compressed file containing a ransomware binary to a Windows server, only for it to get blocked by the organization’s endpoint detection and response tool.

Having already scanned the victim’s network, Akira switched to targeting a Linux webcam that had known vulnerabilities, “including remote shell capabilities,” as well as scant memory, meaning it wasn’t – and likely could never be – running EDR software. Attackers infected the webcam with malware, which distributed ransomware via Server Message Block traffic.

“Akira was subsequently able to encrypt files across the victim’s network,” S-RM said.

Regardless of how groups name themselves or what IoT devices they may eventually hack, experts say the message for defenders remains clear: Maintaining up-to-date, secure backups, to be able to restore systems without having to pay a ransom for a decryptor, is a must.

Also essential: deploying defenses to counter the tactics ransomware groups keep using to gain initial access to a victim’s network. Ransomware responder said the most-seen tactics include using emails to infect systems with malware, exploiting unpatched vulnerabilities or remote-access misconfigurations and obtaining legitimate credentials via information-stealing malware.