One cybersecurity firm’s global incidence response data for Q1 is pointing to several shifts in cybercriminal tactics among its user ecosystem.

For the first quarter of 2025, one cybersecurity firm’s global incidence response data has been analyzed to yield several new cyber trends noted for that period.

First, attackers were deploying “EDR killers” to disable endpoint detection and response tools, and increasingly targeting cloud environments.

Second, the most active ransomware variant encountered in Q1 was RansomHub. Also:

• Users in manufacturing remained the top sector targeted by ransomware, followed by wholesale and retail, and professional and legal services, and the most targeted regions were the firm’s users in the US, Canada, the UK, and Germany.
• There was a rise in AI-generated identities, particularly by North Korean operatives posing as remote IT workers, to steal sensitive code and extort organizations.
• Attackers were not just relying on encrypting compromised data to demand ransoms in Q1, but were added tactics such as using fake data, and even physical ransom notes, sent to the homes of corporate victims.

EDR killers are specialized tools or malware designed to disable, impair, or evade security systems on compromised machines. They work by exploiting vulnerabilities in legitimate drivers (kernel-level software) to gain privileged access, allowing them to terminate EDR processes and services at a low level. Techniques include process injection, process termination, driver manipulation, altering firewall rules to block EDR communication, and direct manipulation of kernel structures. Some are sold on underground markets and used widely by ransomware groups.

According to Philippa Cogswell, Vice President and Managing Partner, Unit 42 (Asia-Pacific & Japan), Palo Alto Networks, the firm sharing out its Q1 data, attackers had been shifting from traditional encryption tactics to more aggressive and manipulative methods including false claims, insider access, and tools that disable security controls: “These new and evolving tactics show just how critical it is for organizations to move beyond reactive defenses” and use “strategies that provide full visibility and rapid response across their environments.”