CyberHappenings logo
☰
🏠 Home 📂 Browse ℹī¸ About

Akira and Cl0p lead most active RaaS groups in 2025

First reported
Last updated
📰 1 unique sources, 1 articles

Summary

Hide ▲

Akira and Cl0p are the most active ransomware-as-a-service (RaaS) groups in 2025. Ransomware attacks increased by 179% in the first half of 2025 compared to the same period in 2024. The RaaS model enables lower-skilled threat actors to launch attacks. Manufacturing and technology sectors, along with the US, are primary targets. The RaaS model's proliferation is attributed to its accessibility and affordability, enabling a wider range of threat actors to engage in ransomware attacks. The top five most prolific RaaS groups include Akira and Cl0p, with notable tactics such as rebranding and using leaked ransomware source code. The landscape is evolving with groups like RansomHub and Weyhro focusing on pure extortion without encryption. AI tools, such as large language models (LLMs), are being integrated into operations, with Funksec using AI-created phishing templates and WormGPT.

Timeline

  1. 28.08.2025 21:49 📰 1 articles

    Akira and Cl0p lead most active RaaS groups in 2025

    Akira and Cl0p are identified as the most active RaaS groups in 2025, with a 179% increase in ransomware attacks in the first half of the year compared to 2024. The RaaS model enables lower-skilled threat actors to launch attacks, targeting primarily the manufacturing and technology sectors, along with the US. The landscape is evolving with groups like RansomHub and Weyhro focusing on pure extortion without encryption. AI tools, such as large language models (LLMs), are being integrated into operations, with Funksec using AI-created phishing templates and WormGPT.

    Show sources
    Open in new tab

Information Snippets