Table of Contents

Cyberthreat Analysis

• Ransomware and Cyber Extortion in Q4 2025
• Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS
  

Industry News

#NMFTACyber On Demand

Ransomware and Cyber Extortion in Q4 2025

In the final quarter of 2025 (Q4 2025), established groups like “Qilin” and “Akira” maintained their leadership positions, while newer operators like “Sinobi” gained traction.

In addition, the number of data-leak site posts increased by 50% between Q3 and Q4 2025, and was up 40% from Q4 2024, despite fewer active groups this quarter.

Reliaquest assessed with moderate confidence that this reflects short-term consolidation, where higher-output groups attacked more organizations as weaker operators lost momentum.

Regardless of which groups rise or fall quarter to quarter, the sustained increase in data-leak site posts emphasizes that ransomware remains a persistent, growing threat even as individual group names come and go.

The quarter was characterized by the following developments:

• Sinobi’s rapid expansion: Listings attributed to Sinobi rose 306%, making it Q4's third-most active group. This increase likely reflects affiliate migration from declining operations like “Lynx” ransomware.
• Clop’s operational resurgence: After minimal Q3 activity, “Clop” claimed 116 victims through mass exploitation of a widely used enterprise resource planning (ERP) solution software platform.
• Sectoral variations: Traditional high-value sectors—professional, scientific, and technical services (PSTS), manufacturing, and health care—remained the most affected industries, while retail trade experienced a 152% spike, likely driven by opportunistic holiday-season targeting.

By analyzing the drivers behind these trends and their downstream impact across industries, this report provides organizations with actionable insights to stay ahead of both established and emerging ransomware threats.

Guidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaS

Mandiant is tracking a significant expansion and escalation in the operations of threat clusters associated with ShinyHunters-branded extortion. As detailed in our companion report, 'Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data Theft', these campaigns leverage evolved voice phishing (vishing) and victim-branded credential harvesting to successfully compromise single sign-on (SSO) credentials and enroll unauthorized devices into victim multi-factor authentication (MFA) solutions.

This activity is not the result of a security vulnerability in vendors' products or infrastructure. Instead, these intrusions rely on the effectiveness of social engineering to bypass identity controls and pivot into cloud-based software-as-a-service (SaaS) environments.

This post provides actionable hardening, logging, and detection recommendations to help organizations protect against these threats. Organizations responding to an active incident should focus on rapid containment steps, such as severing access to infrastructure environments, SaaS platforms, and the specific identity stores typically used for lateral movement and persistence. Long-term defense requires a transition toward phishing-resistant MFA, such as FIDO2 security keys or passkeys, which are more resistant to social engineering than push-based or SMS authentication.

Refer a Colleague

Would you like others at your company to be added to the NMFTA Headline Newsletter email distribution list? Send them this link or fill out the form for them on their behalf below!