Loading story…
Multiple cybersecurity reports highlight a surge in both ransomware and infostealer malware activity targeting organizations worldwide in late 2025. Notably, Qilin ransomware targeted a South Korean semiconductor back-end firm and a private equity firm, while data from a South Korean online ticketing platform was sold on dark web forums. The French interior ministry also faced a data breach, with claims surfacing on BreachForums and a suspect subsequently arrested. These incidents underscore the persistent threat posed by ransomware groups, with attacks affecting critical infrastructure sectors such as manufacturing, healthcare, and finance. The November 2025 threat trend report details the prevalence of major ransomware groups like Clop, Akira, and Qilin, and provides statistics on affected industries and regions.
In parallel, infostealer malware campaigns have intensified, with Phantom Stealer version 3.5 emerging as a sophisticated threat capable of extracting sensitive data such as passwords, browser cookies, and cryptocurrency wallet information. This malware often masquerades as legitimate software installers, employing advanced evasion and process injection techniques to avoid detection. The November 2025 Infostealer Trend Report notes that infostealers like ACRStealer, LummaC2, and Rhadamanthys are frequently distributed via cracked software and SEO poisoning. Additionally, phishing campaigns using purchase order-themed PDFs are being used to harvest business credentials and system information, which are then exfiltrated to attackers via Telegram for further exploitation or sale.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
Researchers described Phantom Stealer v3.5 as an active infostealer distributed through fake Adobe installers and other deceptive lures. The malware uses obfuscated scripts, process injection, anti-analysis techniques, and exfiltration over channels including SMTP, FTP, Telegram, and Discord to steal credentials, cookies, payment data, and wallet information.
A claim alleging a data breach involving the French interior ministry was posted on BreachForums. ASEC also noted that a suspect connected to the incident was arrested.
Data allegedly taken from a South Korean online ticketing and reservation platform was advertised for sale on DarkForums, indicating a breach affecting the service. ASEC included the sale in its roundup of notable December 2025 dark web incidents.
ASEC reported that the Qilin ransomware group targeted a South Korean semiconductor back-end company and a South Korean private equity firm in December 2025. The incidents were part of broader ransomware and dark web activity tracked during the month.
Analysis of the phishing kit’s heavily obfuscated JavaScript revealed that it harvested credentials and victim telemetry such as browser, OS, language, cookies, screen size, and location. The stolen data was exfiltrated via POST requests to an attacker-controlled Telegram bot and forwarded to a hardcoded Telegram chat.
Multiple phishing PDFs, including one titled “NEW Purchase Order # 52177236.pdf,” were observed linking to the same ionoscloud.com subdomain, indicating a credential-harvesting campaign reusing shared infrastructure across lures. The phishing pages pre-filled victims’ email addresses and targeted business email credentials.
AhnLab’s November 2025 infostealer report found ACRStealer, LummaC2, Rhadamanthys, and AURA Stealer to be the most prevalent families, with DLL sideloading used in 77.3% of samples. The report also noted SEO poisoning, abuse of legitimate sites and forums, and mass distribution of a new loader variant.
AhnLab’s November 2025 ransomware trend report documented continued growth in attacks worldwide, especially against manufacturing, healthcare, and finance. The report highlighted activity from both established and newly emerged ransomware groups based on AhnLab and leak-site data.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
asec.ahnlab.com
Open sourcecybersecuritynews.com
Open sourcemalwarebytes.com
Open sourceasec.ahnlab.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Malware activity surged in Q3 2025, with the Center for Internet Security (CIS) reporting a 38% increase in notifications compared to the previous quarter. SocGholish remained the most prevalent malware, accounting for 26% of detections, and was often used to deliver additional payloads such as NetSupport and AsyncRAT. The quarter also saw the re-emergence of Gh0st, Lumma Stealer, and TeleGrab, as well as the debut of Jinupd, a downloader distributed via phishing and compromised websites. Lumma Stealer, notable for its infostealing and evasion capabilities, returned after law enforcement action against its infrastructure. Infection vectors tracked included dropped malware, malspam, and malvertising. Separately, eSentire identified a November 2025 campaign leveraging ClickFix as an initial access vector to deploy Amatera Stealer and NetSupport RAT. Amatera Stealer, a rebranded version of ACR (AcridRain) Stealer, is capable of exfiltrating data from crypto-wallets, browsers, and messaging apps, and uses advanced evasion techniques to bypass security products. The campaign highlights the continued evolution and rebranding of stealer malware, as well as the persistent use of remote access tools like NetSupport in active threat campaigns.
Jun 29, 2026
Cybersecurity agencies and researchers reported a surge in sophisticated cybercrime operations and malware campaigns in December 2025. Notable law enforcement actions included the takedown of major cybercriminal forums such as Cracked and Nulled, and the disruption of ransomware networks like Phobos/8Base, as highlighted in SOCRadar's review of top law enforcement operations. Concurrently, threat intelligence sources documented a rise in ransomware attacks, with LockBit 5.0 targeting 25 companies globally, and agencies intensifying pressure on pro-Russian hacktivist groups. The month also saw a significant malware incident in New Zealand, where the national cyber security agency warned 26,000 citizens about infections by Lumma Stealer, a credential-harvesting malware. Technical research revealed the continued evolution of information-stealing malware, such as Stealc and Phantom Stealer, which leverage new delivery methods including Discord-hosted payloads and fake software updates. The Mirai botnet family demonstrated renewed activity, with new variants like Broadside and Jackskid exploiting IoT vulnerabilities and targeting sectors such as maritime logistics. Reports also underscored the growing threat of browser-based attacks, with critical vulnerabilities being disclosed throughout the year, and the increasing use of social engineering tactics to bypass security controls. These developments reflect a rapidly shifting threat landscape, with attackers adopting advanced techniques and law enforcement responding with coordinated global operations.
Jun 29, 2026
Ransomware operators are increasingly leveraging supply chain attacks and credential harvesting to expand their reach and maximize profits. Notable groups such as Qilin, Akira, Sinobi, INC Ransom, and Play have been identified as leading actors, with the Clop group repeatedly exploiting zero-day vulnerabilities in widely used software, including managed file transfer solutions and Oracle E-Business Suite, to compromise multiple organizations simultaneously. The volume of ransomware victims listed on data leak sites surged by one-third from September to October, according to Cyble, highlighting the persistent threat posed by these actors. Despite a decrease in total ransom payments from $1.25 billion in 2023 to $814 million in 2024, ransomware groups are actively innovating to reverse this trend, including launching new affiliate programs and refining their attack techniques. However, some operations have suffered from sloppy coding, occasionally resulting in unrecoverable data. The continued evolution of ransomware tactics underscores the need for organizations to strengthen defenses against both direct and supply chain threats, as well as to monitor for credential harvesting activities that may precede future attacks.
Jun 29, 2026