{"id":55769,"date":"2025-05-13T11:45:59","date_gmt":"2025-05-13T08:45:59","guid":{"rendered":"https:\/\/saudishopper.com.sa\/en\/?p=55769"},"modified":"2025-05-13T11:46:07","modified_gmt":"2025-05-13T08:46:07","slug":"top-cybercrime-groups-2025","status":"publish","type":"post","link":"https:\/\/saudishopper.com.sa\/en\/top-cybercrime-groups-2025\/","title":{"rendered":"Group-IB Reveals Top 10 Most Dangerous Cybercrime Groups for 2025"},"content":{"rendered":"\n

UAE \u2013 May 13, 2025:<\/strong> Group-IB, a global leader in cybersecurity solutions, has released its list of the Top 10 Most Dangerous Cybercrime Groups for 2025. This ranking provides organizations with critical intelligence on the most active and sophisticated threat actors that are shaping the global cyber threat landscape. The list is part of Group-IB\u2019s latest High-Tech Crime Trends Report, which offers in-depth analysis, forecasts, and actionable insights from over 1,550 successful high-tech crime investigations.<\/p>\n\n\n\n

The Top 10 Most Dangerous Cybercrime Groups of 2025<\/strong><\/h2>\n\n\n\n

Group-IB has identified the following 10 cybercrime groups as the most dangerous for 2025, based on their scale, sophistication, and impact across sectors and geographies:<\/p>\n\n\n\n

1. RansomHub<\/strong><\/h3>\n\n\n\n
    \n
  • Type:<\/strong> Ransomware-as-a-Service (RaaS)<\/li>\n\n\n\n
  • Activity:<\/strong> Emerged after the disappearance of ALPHV (BlackCat) and quickly gained dominance, responsible for nearly 20% of ransomware victims between February and September 2024.<\/li>\n\n\n\n
  • Targets:<\/strong> Industrial manufacturing and healthcare sectors.<\/li>\n<\/ul>\n\n\n\n

    2. GoldFactory<\/strong><\/h3>\n\n\n\n
      \n
    • Type:<\/strong> Mobile banking malware.<\/li>\n\n\n\n
    • Activity:<\/strong> Developer of GoldPickaxe.iOS, the first known iOS trojan that steals facial recognition data for deepfake-enabled financial fraud.<\/li>\n\n\n\n
    • Targets:<\/strong> Financial institutions and mobile users.<\/li>\n<\/ul>\n\n\n\n

      3. Lazarus<\/strong><\/h3>\n\n\n\n
        \n
      • Type:<\/strong> State-linked cyber espionage and financial theft.<\/li>\n\n\n\n
      • Activity:<\/strong> A North Korean group responsible for stealing over $1.3 billion from financial institutions and cryptocurrency platforms in 2024.<\/li>\n\n\n\n
      • Targets:<\/strong> Financial and cryptocurrency sectors worldwide.<\/li>\n<\/ul>\n\n\n\n

        4. DragonForce<\/strong><\/h3>\n\n\n\n
          \n
        • Type:<\/strong> Hacktivist and ransomware group.<\/li>\n\n\n\n
        • Activity:<\/strong> Rapidly expanding operations globally, targeting governments and corporations across multiple industries.<\/li>\n\n\n\n
        • Region:<\/strong> Likely linked to DragonForce Malaysia.<\/li>\n<\/ul>\n\n\n\n

          5. OilRig<\/strong><\/h3>\n\n\n\n
            \n
          • Type:<\/strong> Advanced persistent threat (APT).<\/li>\n\n\n\n
          • Activity:<\/strong> Specializes in sophisticated phishing attacks to gather intelligence from finance, energy, telecom, and government entities.<\/li>\n\n\n\n
          • Region:<\/strong> Middle East.<\/li>\n<\/ul>\n\n\n\n

            6. MuddyWater<\/strong><\/h3>\n\n\n\n
              \n
            • Type:<\/strong> Cyber espionage.<\/li>\n\n\n\n
            • Activity:<\/strong> Focuses on spear-phishing campaigns targeting NATO-affiliated nations.<\/li>\n\n\n\n
            • Region:<\/strong> Middle East.<\/li>\n<\/ul>\n\n\n\n

              7. Brain Cipher<\/strong><\/h3>\n\n\n\n
                \n
              • Type:<\/strong> Ransomware-as-a-Service (RaaS).<\/li>\n\n\n\n
              • Activity:<\/strong> Gained notoriety after demanding an $8 million ransom from Indonesia\u2019s national data center in 2024.<\/li>\n\n\n\n
              • Region:<\/strong> Global.<\/li>\n<\/ul>\n\n\n\n

                8. Boolka<\/strong><\/h3>\n\n\n\n
                  \n
                • Type:<\/strong> Advanced web vulnerability exploitation.<\/li>\n\n\n\n
                • Activity:<\/strong> Specializes in exploiting website vulnerabilities with stealthy tactics and modular malware.<\/li>\n\n\n\n
                • Region:<\/strong> Global, affecting thousands of businesses.<\/li>\n<\/ul>\n\n\n\n

                  9. Ajina<\/strong><\/h3>\n\n\n\n
                    \n
                  • Type:<\/strong> Android malware group.<\/li>\n\n\n\n
                  • Activity:<\/strong> Targets banking app users with sophisticated malware, with over 1,400 unique samples analyzed by Group-IB.<\/li>\n\n\n\n
                  • Region:<\/strong> Central Asia, with a growing global reach.<\/li>\n<\/ul>\n\n\n\n

                    10. Team TNT<\/strong><\/h3>\n\n\n\n
                      \n
                    • Type:<\/strong> Cryptojacking and brute-force attacks.<\/li>\n\n\n\n
                    • Activity:<\/strong> Focuses on cloud environments, including Kubernetes, Redis, and Docker, for illegal cryptocurrency mining.<\/li>\n\n\n\n
                    • Region:<\/strong> Global.<\/li>\n<\/ul>\n\n\n\n

                      Group-IB\u2019s Commitment to Enhancing Cybersecurity Awareness<\/strong><\/h2>\n\n\n\n

                      To help organizations better understand and defend against these emerging threats, Group-IB has launched the \u201cMasked Actors\u201d podcast series, hosted by cybersecurity expert Gary Ruddell and Nick Palmer, VP of Global Sales at Group-IB.<\/p>\n\n\n\n

                      \u201cMasked Actors\u201d Podcast Series:<\/strong><\/h3>\n\n\n\n
                        \n
                      • First Episode:<\/strong> Focuses on the GoldFactory threat group.<\/li>\n\n\n\n
                      • Availability:<\/strong> Streaming on all major podcast platforms starting May 13, 2025.<\/li>\n\n\n\n
                      • Purpose:<\/strong> Provides in-depth insights into the tactics, techniques, and motivations of the world\u2019s most dangerous cybercrime groups.<\/li>\n<\/ul>\n\n\n\n