- The Bitsight Platform detected attacks against 573 organizations in January 2025, in comparison with 619 in December.
- The group KillSec was responsible for the highest number of ransomware attacks this month.
- Juggernaut extortion operation Funksec remained in the top three groups this month, after launching its dedicated leak site (DLS) in December 2024. While Funksec has claimed scores of victims, the group carries out multiple types of attacks, including data breaches, ransomware attacks, and website defacement. Bitsight's victimology statistics aggregate all of Funksec’s attacks.
January 2025
Threat Intelligence Report
Ransomware news
1The listed groups above accounted for 70% of all ransomware attacks among the top 10 operations in January 2025. The other five groups in the top 10 consisted of INC (7%), 8base (7%), Medusa (6%), Qilin (6%), and Cloak (4%). |
|
Trending topics of the month
AKULA Breach Bot
A new version of the popular Telegram breach bot AKULA was launched, which enables channel subscribers to retrieve credentials for various organizations. Hackers can exploit these credentials to gain initial access to accounts, acting as the first step in broader cyber incidents.
Bitsight detected an AKULA subscriber producing credentials for a major media company that was subsequently attacked by an established ransomware operation.
Within two weeks, the channel had close to 7,000 subscribers and had collected tens of billions of records.
Top 3 Vulnerabilities in January
Top CVEs of the month based on Bitsight Data Mechanisms
The Dynamic Vulnerability Exploit (DVE) Module score reflects the probability of a vulnerability being exploited by malicious actors over the course of 90 days.
An Analysis of the Top Mentioned Malware in January
Redline Malware
In January 2025, Redline malware had the highest number of mentions in the underground sources collected by the Bitsight Portal, despite an October 2024 sting that seized assets belonging to both the Redline and Meta operations.
Redline and Meta shared infrastructure and ran two of the most popular stealer malware operations on the underground.
The task force that took down Redline and Meta, dubbed Operation Magnus, accessed source code, license servers, REST-API services, panels, stealer binaries, and Telegram bots for both Redline and Meta.
Despite Operation Magnus’ success, Bitsight continued to observe threat actors on the underground spreading cracked versions of RedLine.
Spotlight on a Threat Actor
b0nd
B0nd is an active member of the leading English-language cybercrime platform BreachForums who does not appear to be part of established ransomware or data extortion groups.
Throughout January 2025, b0nd published 15 posts or replies.
Among b0nd’s notable activity was an attempt to sell over 18 million records related to customers of a UK telecommunications giant. The threat actor also advertised the data on a Russian forum called XSS.
B0nd demanded $30,000 in cryptocurrency for the data set, and deleted the posts from both BreachForums and XSS, suggesting a buyer may have acquired the content.
APTs During the Month of January
APTs During the Month of January
A hacktivist collective called Silent Crow attacked a Russian federal agency, claiming it stole two billion lines of data related to Russian citizens.
While Rosreestr denied it had been breached, Bitsight observed Silent Crow leaking sample data and providing proof of the alleged attack on the group’s official Telegram channel.
Subsequently, Bitsight detected Silent Crow announcing a second breach targeting a Russian subsidiary of an automotive company.
Silent Crow’s statements suggest they are of Ukrainian origin.