Ransomware in 2025: Shifting Tactics, Falling Profits

Du'aine Davis

Observed in the wild

• Throughout 2025, ransomware remained a major global threat, impacting organisations across Europe, North America, APAC and South America, with a clear shift towards smaller organisations. Google Threat Intelligence and Mandiant observed a record number of victims posted to data leak sites, driven by declining ransom payments and improved victim recovery, alongside increased data theft extortion even when encryption was not deployed.
• Threat actors primarily gained access via exploited vulnerabilities in VPNs, firewalls and exposed services (including SharePoint), stolen credentials, and malvertising. RaaS groups such as REDBIKE, Qilin and Akira dominated. Common behaviours included abuse of RMM tools, credential dumping, lateral movement via RDP/SMB, targeting virtualisation infrastructure, and disabling Microsoft Defender through registry and PowerShell manipulation.
• Organisations are advised to prioritise rapid patching of internet-facing systems, enforce MFA on VPNs and RDP, and monitor Defender alerts for tamper attempts, registry changes, suspicious PowerShell, and abnormal use of RMM tools. Enable Defender Tamper Protection, audit exclusions, restrict admin privileges, and monitor for Rclone, WinRAR, credential dumping and Defender disablement behaviours indicative of pre-ransomware activity.

Ransomware Tactics, Techniques, and Procedures in a Shifting Threat Landscape | Google Cloud Blog