INTELLIGENT BRANDS // Enterprise Security

The findings are drawn from Group-IB’ s latest High-Technology Crime Trends

Report, which delivers in-depth analysis, forecasts, and actionable insights from over 1,550 successful high-technology crime investigations.

Group-IB identified the 2025 Masked Actors through extensive intelligence, highlighting the scale, sophistication, and impact of these active threat groups across sectors and geographies.

The 2025 top ten masked actors include:

RansomHub – The Ransomware-as-a- Service, RaaS operation that surfaced after ALPHV, BlackCat disappeared. Accounting for nearly a fifth of ransomware victims between February and September 2024, it has quickly become a dominant force, targeting industrial manufacturing and healthcare sectors. GoldFactory – A nefarious mobile banking malware group responsible for GoldPickaxe. iOS, the first known iOS trojan designed to harvest facial recognition data for deepfakeenabled financial fraud. Lazarus – A North Korea-linked threat actor responsible for high-profile attacks on financial institutions and cryptocurrency platforms, with over $ 1.3 billion stolen in 2024 alone.

DragonForce – An emerging hacktivist and ransomware group possibly linked to DragonForce Malaysia, that’ s rapidly expanding its operations globally. It targets governments and corporations across multiple industries. OilRig – A Middle East-based group that’ s been active for over a decade. OilRig specialises in increasingly sophisticated phishing attacks to gain intelligence from finance, energy, telecom, and government entities. MuddyWater – Another Middle East-based group. MuddyWater focuses on cyber espionage campaigns targeting NATOaffiliated nations, particularly through spearphishing campaigns. Brain Cipher – A new Ransomware-as-a- Service, RaaS group that surfaced in mid- 2024. It made headlines after demanding an $ 8 million ransom following an attack on Indonesia’ s national data centre. Boolka – Representing a new wave of cybercriminals, Boolka specialises in exploiting website vulnerabilities. The group’ s evolving stealth tactics and ability to adapt and deploy modular malware causes significant financial and reputational damage that’ s likely affected thousands of businesses and users worldwide. Ajina – A rapidly growing Central Asian cybercrime group targeting everyday users of banking applications through sophisticated Android malware campaigns. Group-IB analysed over 1,400 unique samples, suggesting a significant number of affected users and an increasing global reach.

Team TNT – Likely the most prolific Malicious Minds in crypto crime, Team TNT has gained infamy for its relentless cloudfocused cryptojacking and brute-force attacks, targeting Kubernetes, Redis, and Docker environments.

A detailed overview of the top global threats, key threat actors, and their evolving tactics is available in the full High-Technology Crime Trends 2025 report.

The report provides in-depth insights into the evolving threat landscape, equipping businesses and cybersecurity professionals with the intelligence to stay safe.

Headquartered in Singapore, and with Digital Crime Resistance Centres in the Middle East and Africa, Europe, Central Asia, and the Asia-Pacific, Group-IB analyses and neutralises regional and country-specific cyber threats via its Unified Risk Platform.

Group-IB collaborates with international law enforcement agencies like INTERPOL, EUROPOL, and AFRIPOL to fortify cybersecurity worldwide, and has been awarded by advisory agencies including Aite-Novarica, Gartner, Forrester, Frost & Sullivan, and KuppingerCole. p

www. intelligentcio. com INTELLIGENTCIO MIDDLE EAST 69