2024 has had its ups and downs, with geopolitical tensions rising in the Middle East and enterprises rapidly adopting generative AI and automation. These changes have widened organizations’ cyber attack surface, allowing threat actors to choose the most efficient ways to infiltrate networks. While 2024 generally saw the same tried-and-true techniques, 2025 is expected to bring new vulnerabilities and increased targeting of certain organizations by hacktivist groups due to geopolitical shifts. In this blog, the ReliaQuest Threat Research team shares three of its five predictions for 2025’s threat landscape and offers practical defense strategies. The full report covers two more predictions and provides much more detail.  

Cross-Border Alliances: Ransomware’s New Frontier

Prediction: Ransomware activity will return to pre-2024 levels, as new ransomware groups such as RansomHub rise to prominence. In 2025, we anticipate more vishing (voice phishing) and fake IT helpdesk scams targeting English-speaking firms.

In late 2024, Russian ransomware groups began collaborating with native English speakers, boosting their social engineering capabilities. Previously, Russian-speaking ransomware operators dominated and avoided collaborations with English speakers, but groups like the English-speaking Scattered Spider collective have earned Russian-speaking cybercriminals’ respect with high-profile attacks. Cybercriminal forum discussions reflected this shift, with users now discussing the merits and risks of these partnerships. 

Forum moderator opines Scattered Spider shows why “it’s still worth working with English speakers,” despite “how quickly they get caught” (translated from Russian)  

This collaboration leads to new risks, as involving native English-speakers in ransomware attacks facilitates lesser-known social engineering techniques like vishing and helpdesk scams. End users, often wary of messages with typos and errors, may be more easily deceived by error-free communications. 

In October 2024, we saw this collaboration’s impact, investigating a customer intrusion that we attributed with high confidence to Scattered Spider. The group social-engineered the organization’s help desk, employing fluent English to achieve a reset of a compromised account’s password. That same month, we revealed a new Black Basta social engineering campaign, where threat actors posed as helpdesks, adding users to Microsoft Teams chats and tricking them into joining “support” sessions using Remote Management and Monitoring (RMM) tools.  

We expect that in 2025, collaborations between English- and Russian-speaking threat actors will persist, making these social engineering techniques more common. 

LLMs: Balancing Innovation with Risk

Prediction: In 2025, we expect 8-10% of our investigations to involve threat actors abusing internal large language model (LLM) tools. As more companies adopt LLMs for efficiency, the risks of data breaches, insider threats, and ransomware attacks will intensify. Adversaries will use these LLMs to access data faster and exploit vulnerabilities.

By late 2024, market analysts labelled artificial intelligence (AI) a “bubble” that might soon burst. Despite this, companies, especially those with investments in LLMs, are eager to boost productivity with AI. Organizations are integrating tools like cloud storage and databases into LLMs, enabling natural language queries. This consolidation simplifies access for employees but also for potential threat actors, reducing the time needed to locate sensitive data and the requirement to know exactly what they were looking for and where to find it. With a misconfigured LLM, an adversary can simply use plain language to access sensitive information. As one of our data scientists put it, “instead of just breaking into your house, an attack on an LLM with tool integrations gives a burglar access to your house and your butler.”  

Beyond misconfigurations, LLMs come with a host of vulnerabilities. For instance, OpenAI’s “Memories” feature in ChatGPT, designed to retain information across chats, has been exploited for prompt injection and data exfiltration, even after patches. Despite efforts by LLM vendors to patch vulnerabilities and create safeguards, LLMs remain susceptible to prompt injections. Users share these prompts on dark web forums, making them easily accessible to threat actors aiming to exploit LLMs in their attacks. 

LLM vendors also issue API keys. But if an API key is exposed, it can lead to significant costs, as LLM vendors charge customers per token, with each query usually counting as one token. A leaked API key could allow hackers to inundate the API with automated requests, resulting in outages and exorbitant costs. This straightforward yet highly effective attack can be exploited by hacktivists or insider threats looking to financially harm a company. 

A BreachForums user shares jailbreaking prompts for several LLMs 

2025 – The Year of Digital Dissent

Prediction: We forecast an increase in hacktivism driven by social justice issues. While often tied to geopolitical events, rising social unrest and police crackdowns on environmental protests may push activist groups to adopt hacktivist tactics. These could include DDoS attacks, mass email bombings, and data leaks. We expect that existing hacktivist groups will rely less on distributed denial of service (DDoS) attacks, favoring tactics like ransomware and data exfiltration.

The open-source availability of ransomware builders has made ransomware-as-a-service (RaaS) more accessible, leading hacktivist groups to launch their own services. By June 2024, the pro-Russian group “KillSec,” initially part of the Anonymous movement, expanded from website defacements and data breaches to offering a RaaS program. This enables even less skilled cybercriminals to engage in cyber extortion with customizable ransomware

KillSec advertises a second version of a RaaS platform on Telegram 

We predict that in 2025, more hacktivist groups, including pro-Palestinian groups, will venture into financially motivated cybercrime. Ransomware attacks help hacktivists attract attention and damage targets while funding their campaigns through cryptocurrency. This shift may boost hacktivist activity by providing a means to earn a living while supporting their causes, moving beyond voluntary hacktivism. Additionally, ransomware and data exfiltration attacks will likely gain more attention than DDoS attacks, which have become routine and attract less media focus after years of intense hacktivism. 

In 2025, social unrest is expected to escalate due to the Israel-Hamas-Hezbollah conflict, disinformation, and anti-immigration sentiment across the US and Europe. These issues, combined with economic concerns and AI-induced job fears, have fueled protests worldwide. As traditional protests face police intervention, social justice activists may increasingly adopt hacktivist tactics. Groups like Extinction Rebellion have launched Digital Rebellions, targeting the insurance industry over fossil fuel policies using email spamming and social media storms. These low-skill methods could become more popular among climate activists, alongside strategies like DDoS attacks, website defacement, and data theft.  

Extinction Rebellion launches “Digital Rebellion” campaign targeting the insurance industry for their involvement with fossil fuels 

Countering the Threat with ReliaQuest

By continuously monitoring network activity, GreyMatter can detect unusual patterns indicating a ransomware attack, enabling immediate intervention to prevent data encryption. GreyMatter’s Automated Response Playbooks rapidly isolate affected systems and block malicious IP addresses, mitigating the attack’s impact. The GreyMatter Intel feature keeps your organization up to date on hacktivist and ransomware activities, with filters for sector and geography to access relevant intelligence updates. 

While LLMs offer versatility and tool integration benefits, they also enable threat actors to rapidly inflict damage, far outpacing the capabilities of an average security operations center. Automated Response Playbooks reduce mean time to contain (MTTC) threats to as low as five minutes, halting attacks quickly. GreyMatter Digital Risk Protection detects and addresses API key exposures, exposed credentials, and other assets before they can be exploited. 

Conclusion

The 2025 cybersecurity landscape brings challenges and opportunities as organizations face a rapidly changing threat environment. While threat actors largely relied on tried-and-true techniques in 2024, they have found novel ways to socially engineer their way into networks, new tools, and new reasons to target certain sectors. We expect an increase in ransomware and hacktivist activity, and threat actors leveraging new technologies like LLMs to navigate a corporate network more efficiently.  

As organizations adopt new solutions, it’s crucial to balance the risks of new technologies, while being mindful of the geopolitical tensions which affect the cybersecurity space. Proactive monitoring, comprehensive threat intelligence, and responsive strategies are key to maintaining resilience against emerging threats. 

To read more predictions for 2025, download our full report here.