Massive Surge in Ransomware Attacks: AI and 2FA Bypass to Blame

Ransomware Attacks Surge By 132% Into Q1 2025

Ransomware is not only alive and well, but also rapidly evolving. The latest FBI warning about the Medusa ransomware-as-a-service attacks is proof of this. The good news is that enterprise defenses are improving, and the amount being paid in ransom demands to these criminal gangs is falling fast. However, the bad news is that the same threat intelligence report also revealed that the fast-evolving ransomware landscape has led to a massive surge in attacks.

Ransomware Attacks Surge By 132%

Ransomware attacks surged 132% in Q1 2025, despite a 35% drop in payments. With less ransom being paid out, cybercriminals are shifting their strategies to compensate for the growing number of organizations that have strengthened their security posture to avoid having to pay ransom.

AI-Driven Social Engineering

What if I were to tell you that social engineering using AI deception, commonly known as deepfake phishing or vishing, has increased by an incredible 1,633% in Q1 2025 compared to the last quarter of 2024? This is used as one of the most common methods of gaining initial access to your networks, apart from the fact that it is used to steal session cookies and enable ransomware attackers to access your accounts at leisure.

Adversary-in-the-Middle Attacks

Ransomware attackers are targeting OT devices with greater frequency, and exploiting operational technology environments. The March 25 threat intelligence report from Ontinue revealed all these things and more. "The cyber threat landscape isn’t just evolving, it’s becoming more aggressive," it said.

Ransomware Payments Are Down, But Don’t Bet On It Staying That Way

One of the interesting trends to come out of the Ontinue report was the fact that the amount of money being made by attackers through ransom payments is down a little over a third. Casey Ellis, founder at Bugcrowd, thinks this is fascinating but not surprising. "The combination of increased law enforcement pressure, better international collaboration, and organizations refusing to pay are clearly making a dent," Ellis said. However, the real question is will the downward dip continue. Ellis isn’t convinced. "The ransomware business model is an arms race, and threat actors are nothing if not adaptable," Ellis concluded. "We’ve already seen a shift toward exfiltration-based extortion, stealing data and threatening to leak it if the ransom isn’t paid."

Conclusion

The ransomware threat is not going away anytime soon. As the threat landscape continues to evolve, it is essential for organizations to stay vigilant and implement robust security measures to prevent attacks. With the increasing use of AI-driven social engineering and adversary-in-the-middle attacks, it is crucial to be aware of these tactics and take steps to protect against them.

FAQs

• What is the current state of the ransomware threat?
  Ransomware is not only alive and well but also rapidly evolving.
• What is the current trend in ransomware attacks?
  Ransomware attacks surged 132% in Q1 2025, despite a 35% drop in payments.
• What is the current trend in ransomware payments?
  The amount of money being made by attackers through ransom payments is down a little over a third.
• What is the future of the ransomware threat?
  The ransomware business model is an arms race, and threat actors are nothing if not adaptable.