Proactive threat hunting and fast response to accurately detected suspicious lateral movements of attackers should also be de facto: threat report

Based on information from openly available sources*, a cybersecurity firm has found that February 2025 had 962 cases of ransomware attacks analyzed — a 126% increase of claimed victims year-over-year compared to the same month’s figures analyzed by the same firm in 2024.

Of the 962 cases analyzed, 335 were claimed by the Clop (Cl0p) group: a 300% jump compared to data sources analyzed from January 2025.

It has been asserted that Clop (and other ransomware groups) have shifted tactics to focus on opportunistic attacks using newly discovered software vulnerabilities in edge network devices rather than on specific firms or industries. The idea is that “cybercriminals, regardless of whether they are financially motivated or state-affiliated, focus on finding vulnerabilities that meet certain criteria”:

• The vulnerabilities have high-risk CVSS scores (>7.0)
• The vulnerabilities allow attackers to remotely take control of a system
• The vulnerabilities affect software that is accessible from the Internet
• An exploit developer or malicious actor has already published the proof of concept for the exploitation process

Based on the above hypotheses, “less than 24 hours following the vulnerability’s public disclosure, threat actors launch automated scanners that scour the internet and establish remote access to vulnerable systems. After this initial access blitz, threat actors begin the second stage of the attack – the manual hacking of victims. This second stage takes time. Attackers need to figure out which systems are worth their effort, and then they have to manually hack their way deeper, typically using Living Off the Land techniques to evade detection. This delay means the actual ransomware attack or data theft typically happens weeks or even months after threat actors gain initial access.”

The really practical findings by Bitdefender, the firm that released its monthly threat debrief for February 2025, are that organizations should strengthen three defenses against ransomware risks in general: prioritizing patching of actively exploited vulnerabilities; proactive threat hunting for hidden threats and backdoors; and combining EDR/XDR with SOC/MDR.

*Specified as “things like news reports and research – with data gathered by analyzing Data Leak Portals” where claims cannot be independently verified