[MUSIC PLAYING]
Welcome back to The Deep Dive.
Our mission today is, well, it's
to give you a shortcut to filter through all the noise
and get right to the actionable insights.
Exactly.
We've got the Byer-Nichols threat brief
for the last half of November 2025.
And it's really a snapshot in time.
It shows us who's winning, who's losing,
and maybe most importantly, how the tech itself is changing.
That's right.
And this brief-- I mean, it has input from people
like Jeremy Nichols and Jeff Remitts, so it's solid.
But the key thing it shows is this--
convergence.
Converses of what, exactly?
You're seeing espionage, straight up financial crime,
and huge disruption all blended together.
And understanding that blend is, well,
it's everything for defense.
Absolutely.
We know you don't have the time to wait through all this,
so we're going to pull out those aha moments for you.
Let's start right at the top.
The competition.
Who's leading the ransomware ecosystem right now?
OK, so if you look at the ransomware actors table,
the first name that jumps out is Quilin.
They're holding that top spot.
They account for nearly 20% of all activity, 19.74,
to be exact.
And that kind of persistence, that tells us
they have a really efficient polished operation.
It's a well-oiled machine, but Quilin's consistency
isn't the real headline here.
Right.
The big story is the movement below them.
It's CL0P.
Oh, absolutely.
We saw them down in fifth place last period now.
They've launched themselves into the number two spot.
At 17.1%, a jump like that isn't just gradual growth.
No, that screams a new campaign.
It has to be.
Either a brand new, very effective, zero-day exploit,
or they hit a massive target, like a managed service
provider, and got access to dozens of victims all at once.
And Akira is right behind them, rounding out the top three
at almost 17%.
So when you add those three up Quilin, CL0P, Akira,
you're already at more than half of all the ransomware attacks.
But we can't just look at the top three.
There's a lot of diversification happening
further down the list.
That's what's so fascinating, though.
You have these newer mid-tier groups
that are really competing now, groups like Sonobi
and Dragon Force.
They're tied at just under 5%, but they're showing real momentum.
They're probably using those ransomware
as a service platform to scale up fast.
And then there's a new name on the list, Kazoo.
Yeah, their volume isn't high yet,
but their strategy is what's interesting.
What are they doing differently?
They're focusing almost exclusively on data theft
by hitting web application flaws.
So they're not trying to break down
the front door of the network?
Exactly.
They're going straight for the high-value data
in, say, a customer portal.
It suggests they're playing a longer game,
maybe data-brokering, not just quick extortion.
So a really diverse set of attackers.
Yeah.
That's the perfect transition to who they're actually hitting.
Let's look at the victim profiles.
Well, no surprise.
Manufacturing is still number one, almost 20% of all attacks.
And technology is stable at number two.
Those sectors are just constant targets.
The value of disruption there is so high.
It is.
But the real movement this period was in the middle of the pack.
Retail.
It jumped from fifth place all the way to third.
13%.
That is a clear financial signal.
You mean they're following the money?
Attackers are going for the most direct path to monetization.
Retail has huge amounts of transactional data
and hitting them around big shopping periods
gives them maximum leverage.
On the flip side, financial services actually
dropped from third down to fifth.
Which, you know, it might suggest
that all that investment in security and compliance
in the financial sector is actually working.
It's forcing attackers to look for softer targets.
Speaking of softer targets, this
brings us to what I think is the most alarming number
in the whole brief.
The organization size.
It's just devastating.
It is.
Small businesses.
And they define that as 500 employees or less
account for 72.30% of all victims.
72% and the ticking up from last period.
Nearly three quarters of all ransomware victims
are small organizations.
Why?
Is it just that they don't have the budget for security?
Or is it something more systemic?
It's definitely systemic.
Yes, low budgets mean no dedicated security staff, no CISO.
Right.
But it's also their reliance on third party vendors on MSPs.
If an attacker can compromise just one of those MSPs.
They get the keys to the kingdom, access
to dozens of small businesses at once.
It's just efficient for them.
They've become the default revenue stream
for these ransomware groups.
And while most of these victims are in the US,
we're seeing them app expand.
The US is still dominant at over 56%,
but Canada showed a big jump.
They went from fifth place to second.
Yep, over 7% of victims now.
And we also have new hotspots popping up.
Thailand and Germany are now on the list,
both around 2.5%.
So it's clear the attackers are adapting.
They shift from who they're hitting
to what they're using these trending adversaries.
These are the most dangerous groups
because their motive isn't fixed.
They blend state aligned goals with normal criminal operations.
So one day they could be spying.
And the next they're deploying ransomware.
Precisely.
They might do long-term intelligence gathering.
And then when an opportunity for monetization appears,
they pivot instantly.
The brief names of you, like APT24, Autumn Dragon,
Bloody Wolf.
And what makes them so tough to defend against
is that they have resources and skills
way beyond your typical ransomware crew.
So they're not just buying a toolkit?
Not at all.
A group like APT24, for example,
has known links to geopolitical conflicts.
They might be stealing defense secrets one month.
And then encrypting a power grid for ransom the next.
They're sophisticated, well-funded mercenaries.
And the list of vulnerabilities they're using
really shows that complexity.
It really does.
It shows their total opportunists.
You see them exploiting really old vulnerabilities.
Like that one for the industrial control systems,
the Open PLC SCA to BR.
That's from 2021.
Old tech, that's just hard to patch
in a live factory environment.
But then right next to that, you see them
hitting critical modern infrastructure.
Right, like the Sonic Wall SSL VPN for remote access.
And Microsoft's Windows Graphics component.
They're hitting the entry points.
Yes.
But for me, the single most important vulnerability
on this list.
It's the one in Anthropics Code AI.
Wait, a flaw in a developer AI tool?
That seems incredibly specific.
Why is that such a big deal?
Because it's a massive tell.
It confirms that these advanced groups are already
targeting the generative AI pipeline.
They're going after the tools developers are using.
Exactly.
They know developers are using AI to write code that handles
sensitive data, credentials, you name it.
If they can exploit the AI tool itself,
they can inject malicious code at the source.
It's an attack on software creation itself.
That's a whole new level of supply chain risk.
OK, so from the vulnerabilities,
let's look at the tools they're delivering.
The trending malware.
Let's start with Amateurist dealer.
We're seeing its telemetry everywhere, which
means it's being widely deployed.
It's an info stealer.
So this job is just to siphon off credentials, financial data.
Right.
It's the first stage.
It gathers the fuel for the later ransomware attack.
And what's the one defenders really need to catch early?
That would be Ronin Glowder.
It's a loader.
It's whole purpose is to get a foothold
and then pull down the real payload, like the ransomware itself.
So if you spot that, you have a chance
to break the kill chain.
A critical chance.
If you see Ronin Glowder, you can stop the attack
before the encryption starts.
We're also seeing an evolution of older malware,
specifically Shadow V2.
What does second generation mean here?
It means it's been significantly upgraded
to be more evasive.
It might be polymorphic, changing its own code
to avoid detection.
Or it might be using new command and control
channels to hide its communication.
So the old signatures and defenses
for the original Shadow won't work anymore.
I won't.
Teams need to update their playbooks for this one fast.
And finally, Sternis is spreading rapidly through fishing.
Yeah, it's a high volume threat that feeds right
into those loader ecosystems.
OK, so we've covered the actors, victims, and tools.
Let's connect this to the real world with the top news section.
The infrastructure attacks are just mind-boggling.
They are.
Azure got hit with a 15-terribute per second DDoS attack.
15-terributes from half a million different IP addresses.
That's not an amateur job.
That requires a massive coordinated botnet,
the kind of firepower linked to those blended state
criminal groups we were just talking about.
And it wasn't just Microsoft.
Cloudflare also had a major outage.
Right, a database issue that affected their global network.
It just shows how fragile some of this core infrastructure can be.
We also saw the Ruthhug campaign hijacking thousands
of old end-of-life ASUS routers.
And that's a classic move.
Those routers aren't getting security patches anymore.
So they're an easy, persistent way into home
and small business networks.
Now for the financial crime.
The numbers are huge.
Cybercriminals stole $262 million, just
by pretending to be bank support staff.
Just pure social engineering, it's an incredible return on investment.
And the authorities are trying to clamp down.
We saw crypto-mixer founders sent to prison
for laudering hundreds of millions.
But the sheer volume of money flowing
through these illicit channels is immense.
The legal system is playing catch-up.
And finally, there was the sanctioning
of a Russian bill-approved hosting provider.
Which is significant.
It shows governments are starting to target the infrastructure
that enables these attacks, not just the attackers themselves.
So if we pull this all together, what
are the big takeaways for you, the listener?
I think there are two.
First, the economics of this whole landscape
mean that ransomware led by groups like Quilin and CL0P
is overwhelmingly targeting high volume low defense organizations.
So if you run a small business, especially in the US,
you are square in the crosshairs.
You are the default target.
That's takeaway number one.
And the second is the rise of these incredibly versatile adversaries.
The ones that pivot between spying and stealing.
Exactly.
They're targeting everything from 20-year-old factory equipment
to cutting-edge AI developer tools.
You can't just have one single defense strategy
against a threat that fluid.
It's that blend of espionage trade craft and financial greed
that really defines this moment.
It does.
And if we connect that rapid malware evolution
like we saw with Shadow V2 with the pivot capability
of these groups, it brings up a really important question.
Given that they are already targeting developer AI,
what specific, maybe non-traditional vulnerability
in your supply chain will they go after next?
Maybe it's not your firewall.
Maybe it's a code repository, a cloud configuration tool
you rarely use, or a tiny third-party service provider.
What's that weak link that will exploit to bridge the gap
from that first initial breach to a massive financial payday?
A truly challenging question.
And understanding that a tact flows really
the only way to get ahead of it.
That is a wrap on our deep dive into the November 2025
Cyber Threat Landscape.
Thank you for tuning in.
[MUSIC PLAYING]
[MUSIC]