2025 was characterized by targeted attacks on identities. Cyber criminals used artificial intelligence, deepfakes and automated chat tools to manipulate passwords, voices and personal data. Instead of encrypting entire networks, attackers are increasingly relying on identity misuse and the sale or publication of stolen data.

The latest "Nastiest Malware Report" from OpenText names six groups that have particularly characterized the year:

• Qilin (Agenda) was responsible for more than 200 attacks on hospitals and public institutions. One striking feature was a ransomware control panel that allowed partners to communicate directly with negotiation consultants - an example of the increasing professionalization of the cyber underground.
• Akira was responsible for almost one in five documented ransomware incidents worldwide. The group operates according to clear procedures, uses VPN vulnerabilities and offers its services as a ransomware-as-a-service platform.
• Scattered Spider combined social engineering, SIM swapping and deepfake voices to compromise identities. Despite arrests in September 2025, copycats continue the methods.
• Play Ransomware compromised over 900 managed service providers and used intermittent encryption to speed up attacks and make them harder to detect.
• ShinyHunters infiltrated cloud platforms of global corporations such as Google, Salesforce and Kering. The group uses the timing of GDPR notifications to increase the pressure on affected companies.
• Lumma Stealer serves as the basis for many attacks by collecting and selling access data and cookies from infected systems. This makes even protected environments vulnerable via compromised accounts.

"With ReBeL, farmers can increase their productivity, maximize crop yields and minimize losses that can arise as a result of a lack of manpower, for example," the report states - a reference to the increasing networking between technology, data and targets.

Despite improved protection mechanisms, ransomware remains lucrative. The blackmail economy has stabilized, but financial losses continue to rise. Experts recommend basic measures such as regular patching, strong access controls and targeted awareness-raising against social engineering.