Group-IB unveils top 10 cybercriminal groups
New report reveals rising global digital threat actors
Ransomware incidents alone are rising by 10 pc over the past year
Group-IB reveals the Top 10 Masked Actors for 2025, highlighting the most dangerous cybercriminal groups. Their report and new podcast provide vital insights to help businesses strengthen cybersecurity defenses.
Ransomware incidents alone are rising by 10 pc over the past year
Group-IB, a leading creator of cybersecurity technologies to investigate, prevent and fight, has unveiled a list of the Top 10 Masked Actors for 2025, spotlighting the world’s most prolific cybercriminal groups that are shaping the digital threat landscape.
According to a press statement, the announcement, based on insights from the latest High-Tech Crime Trends Report of Group-IB, comes as cyberattacks surge in frequency and sophistication, with ransomware incidents alone rising by 10 pc over the past year.
The statement adds that leading the 2025 ranking is RansomHub, a Ransomware-as-a-Service (RaaS) syndicate that emerged after the notorious ALPHV (BlackCat) group vanished.
Additionally, RansomHub now accounts for nearly a fifth of global ransomware victims, with a particular focus on industrial and healthcare sectors. Close behind is GoldFactory, infamous for creating GoldPickaxe. iOS, the first iOS trojan to harvest facial recognition data for deepfake-enabled financial fraud.
The statement says that Lazarus, a group allegedly linked to North Korea, remains a persistent threat, responsible for over USD 1.3 billion in cryptocurrency and financial thefts in 2024.
According to the statement, other notable groups include DragonForce, an emerging hacktivist and ransomware collective with global reach and OilRig and MuddyWater, both Middle East-based actors specialising in espionage and phishing against critical industries.
The statement adds newcomers like Brain Cipher and Boolka are making headlines for their stealthy ransomware and website exploitation campaigns, while Ajina and Team TNT continue to target banking app users and cloud infrastructure, respectively.
Moreover, Group-IB is launching the Masked Actors podcast series, hosted by cyber intelligence experts Gary Ruddell and Nick Palmer, with the first episode focusing on GoldFactory and premiering today.
