More than seventy new threat groups have emerged over the first half of this year, with ransomware threat actors in particular gaining ground, according to the latest assessments from Quorum Cyber. 

The Edinburgh-based cyber firm’s 2025 Mid-Year Global Cyber Risk Outlook identifies forty-four ransomware actors operating since the beginning of the year, with one notable example being the new ransomware group Codefinger, which researchers witnessed exploiting legitimate Amazon Web Services features to encrypt cloud storage, marking a troubling trend toward targeting cloud-native infrastructure.

Compiled by Quorum Cyber’s threat intelligence team, the report found that ransomware has dominated the threat landscape over recent months, spiking in March when fifteen new threats were identified, including VanHelsing, Mamona and QWCrypt.

As well as these new generation threats, Quorum also identified a growing convergence between cyber-criminals and state actors.

This trend is perhaps best illustrated by North Korea’s Moonstone Sleet utilising the Russian-language Ransomware-as-a-Service (RaaS) platform Qilin to target software companies. According to the report, this marks the first publicly reported instance of the DPRK-aligned actor deploying commercially available RaaS tooling.

Another new trend to emerge in 2025 is the rise of ‘quadruple extortion’ in ransomware operations. Quorum observed groups like Qilin and DragonForce using ‘innovative’ extortion methods, incorporating services such as legal harassment, AI-driven negotiation bots, and call centres.

This points to the RaaS model having evolved towards greater maturity and scalability, evident in the adoption of enterprise business strategies. Quorum said that this newly discovered white-label model allows cyber-criminal affiliates to rebrand ransomware payloads and customise their attacks for specific targets.

Recommended reading

• 87% of Firms Hit By AI Cyber-attacks
• Cyber-Attack Surface “Impossible to Control”
• Machine Identities Now Outnumber Humans 40,000 to 1

The change in tactics has resulted in some success, with the report highlighting a 53% rise in ransom demands from Q1 2022 to Q1 2025 across all sectors; however, some industries are suffering more than others, such as those in the financial sector, which saw a 179% increase in demands.

“What we’ve seen in H1 2025 is both striking and sobering,” said Paul Caiazzo, Quorum Cyber’s chief threat officer.

“The sheer volume of new entrants, more than seventy new threat groups and MaaS offerings, highlights the unyielding pace of cyber-criminal innovation. As we move into the latter half of 2025, we anticipate further innovation in social engineering, extortion tactics, and cloud abuse. 

“We also expect greater regulatory and legal entanglements as the lines between sanctioned actors and criminal affiliates blur.”