[April-17-2025] Daily Cybersecurity Threat Report

1. Introduction

This report provides an analytical overview of the cyber threat landscape as observed through a specific dataset of incidents reported on April 17, 2025. The analysis is enriched by supplementary threat intelligence research concerning the tactics, techniques, procedures (TTPs), and motivations of relevant threat actors and prevalent attack methodologies. The objective is to deliver actionable intelligence for cybersecurity professionals and decision-makers navigating the complex and dynamic threat environment.

The incidents detailed herein occur against a backdrop of significant geopolitical tensions, particularly the ongoing conflicts related to Russia-Ukraine and Israel-Palestine. These conflicts demonstrably fuel hacktivist operations, often manifesting as Distributed Denial-of-Service (DDoS) attacks aimed at disruption and propaganda.¹ Concurrently, the financially motivated cybercrime ecosystem, dominated by ransomware, continues to evolve. Ransomware groups increasingly employ sophisticated extortion tactics and leverage a thriving underground market for initial access and specialized tooling.

The scope of this analysis is primarily focused on the incidents logged for April 17, 2025, contextualized by the provided research materials. While representing a snapshot in time, these events illuminate broader trends and persistent threats. Key themes emerging from the data include the high volume of DDoS attacks conducted by pro-Russian hacktivist groups, the diversification of ransomware operations employing double extortion tactics across a global victim base, targeted attacks against specific sectors such as Government Administration and Manufacturing, and the pivotal role of online platforms like Telegram and the Tor network in facilitating threat actor operations.

2. Executive Summary

Cyber threat activity observed on April 17, 2025, was marked by a high tempo of operations, primarily characterized by numerous DDoS attacks attributed to hacktivist groups and multiple, distinct ransomware campaigns targeting organizations globally.

The most prominent threat actors active within this dataset included:

• NoName057(16): This pro-Russian hacktivist group dominated the DDoS landscape, launching numerous attacks against Ukrainian and Polish entities. Their targets spanned government, defense, manufacturing, chemical, financial, and aviation sectors, consistent with their established geopolitical motivations and focus on disrupting nations supporting Ukraine.¹
• Sarcoma & Qilin: These ransomware groups demonstrated significant activity, primarily targeting organizations within the United States across diverse industries including Real Estate, Manufacturing, Hospitality, and Education. Both groups claimed substantial data exfiltration volumes, underscoring the prevalent double extortion model.⁴
• SAFEPAY: This ransomware operation was notably active against German and UK organizations, particularly in the manufacturing sector. Their claims involved large data volumes and featured characteristically short extortion timelines (3-4 days), designed to maximize pressure on victims.⁷
• Other Actors: The threat landscape also featured activity from groups including NATION OF SAVIORS (DDoS in Bangladesh), Al Ahad (DDoS against US/Hungarian targets), Space Bears, DragonForce, MEDUSA, RALord (Ransomware across various regions), SECT0R16 (claimed OT access), and initial access vendors like cryptoday and Xirosina operating on underground forums. This diversity highlights a complex ecosystem with multiple actors pursuing varied objectives.

The most prevalent attack types observed were:

• DDoS: Accounting for the majority of reported incidents, DDoS attacks were largely driven by NoName057(16) against Ukrainian and Polish targets, reflecting the weaponization of cyber disruption in geopolitical conflicts.¹ Other groups like NATION OF SAVIORS and Al Ahad also contributed to DDoS activity.
• Ransomware: A significant number of incidents involved diverse ransomware families (Sarcoma, Qilin, SAFEPAY, Space Bears, DragonForce, MEDUSA, RALord). These operations consistently employed double extortion tactics—encrypting data and threatening to leak exfiltrated sensitive information—targeting a global victim base across numerous sectors.⁹
• Initial Access Sales: The data included instances of compromised access credentials and specialized attack tools being offered for sale on underground platforms, indicating an active market that facilitates subsequent cyberattacks.

Victimology analysis revealed Ukraine and Poland as primary targets for DDoS attacks, while the United States and Germany faced significant ransomware activity. Key targeted industries included Government Administration, Manufacturing (including Chemical, Defense, Electronics, Medical Equipment), Aviation & Aerospace, Financial Services/Banking, IT Services, Education, Real Estate, and Hospitality & Tourism.

Key trends underscored by the day’s activity include the strong correlation between DDoS campaigns and geopolitical events, the increasing sophistication and diversification of ransomware TTPs (including the Ransomware-as-a-Service model, double/triple extortion, exploitation of specific CVEs), and the critical operational roles of Telegram (for hacktivist coordination and claims) and the Tor network (for ransomware leak sites and communication).

Strategically, these observations necessitate robust DDoS mitigation capabilities, comprehensive multi-layered ransomware defense strategies (encompassing prevention, detection, and recovery, particularly focusing on data protection), and heightened awareness of the threats posed by the initial access market. Organizations must adopt adaptive security postures to counter these evolving and interconnected threats.

3. Analysis of Observed Incidents (April 17, 2025)

Overview

The cybersecurity incidents reported on April 17, 2025, provide a concentrated snapshot of the broader threat landscape, reflecting ongoing geopolitical cyber conflicts and persistent financially motivated criminal operations. The sheer volume of distinct attacks claimed or executed within this single 24-hour period underscores the high operational tempo maintained by various threat actors. DDoS attacks formed the bulk of the activity, alongside numerous ransomware claims involving significant data exfiltration, and indicators of the supporting underground economy for access and tools.

Breakdown by Attack Category

• DDoS Attacks:
  Distributed Denial-of-Service attacks constituted the most frequent incident type observed. The pro-Russian hacktivist group NoName057(16) was responsible for the vast majority of these, launching a coordinated campaign against targets in Ukraine and Poland. Victims included government entities (National Agency of Ukraine on Civil Service, Polish Agency for Enterprise Development, Przemyśl Municipal Roads Authority), defense-related organizations (Athlon Avia), manufacturing companies (Tochprylad, PESA Bydgoszcz SA.), aviation and aerospace firms (CESARA TELEMETRY), chemical manufacturers (Grupa Azoty and its subsidiaries Sklep Grupa Azoty, Grupa Azoty Puławy, Inwestor Grupa Azoty), financial services (Getin Holding), and government relations firms (Sparing-Vist Centre). This intense focus on Ukraine and Poland, a key NATO ally and supporter of Ukraine, directly aligns with NoName057(16)’s stated mission to destabilize perceived anti-Russian forces and disrupt support networks for Ukraine in the context of the ongoing war.1 The selection of targets within government, defense, and critical industries like chemical manufacturing and transportation suggests an intent to cause maximum disruption to state functions and economic activity supporting the war effort or perceived adversaries.
  Other hacktivist groups also conducted DDoS attacks. NATION OF SAVIORS targeted several businesses in Bangladesh within the Hospitality & Tourism and Cosmetics sectors (Dhaka luxury spa, Novla thai spa, Allure Spa Premium, Neha Thai Spa). This specific targeting pattern diverges significantly from the typical geopolitical focus seen with groups like NoName057(16). While hacktivism can be driven by various ideologies including social or religious motivations ¹⁵, the choice of spa businesses is unusual and might point towards localized grievances, moral policing objectives within Bangladesh, or simply opportunistic targeting by a less sophisticated group. Further observation is required to clarify their specific agenda, which doesn’t align with the major conflict-driven hacktivism trends discussed in available research.²
  The pro-Palestinian hacktivist group Al Ahad claimed responsibility for DDoS attacks against the US-based social media platform 4chan and two Hungarian airports (Győr-Pér International Airport, Budapest Airport). Targeting airports is a common hacktivist tactic aimed at causing disruption and gaining visibility.¹ The attack on 4chan could be symbolic, targeting a platform seen as representative of Western online culture, while the attacks on Hungarian targets might relate to Hungary’s perceived political stance or simply represent accessible targets within the broader anti-Western/anti-NATO narrative often associated with pro-Palestinian and allied groups.¹⁶
• Ransomware Attacks:
  Multiple distinct ransomware operations claimed victims on April 17, highlighting the persistent and diverse nature of this threat. These attacks consistently involved claims of significant data exfiltration, reinforcing the double extortion model as standard practice.

• Sarcoma listed five victims across the USA, Italy, UK, and Taiwan, spanning Real Estate (Kaye Lifestyle Homes, 521GB claimed), Transportation & Logistics (Tralfo, 34GB), Banking & Mortgage (Manchester Credit Union Limited, 6GB), Facilities Services (Schultz Industries, Inc., 61GB), and Arts & Crafts (Ju Percussion Group Foundation, 1.6TB claimed). The extremely large volume claimed from Ju Percussion Group (1.6TB) stands out and could reflect targeting based on data richness or be an inflated figure used for psychological pressure.⁶ The types of data mentioned (Passport IDs, financial reports, PII) confirm a focus on sensitive information to maximize leverage.⁴
• Qilin (Agenda) claimed three US-based victims: Universal Window and Door LLC (Manufacturing, 35GB), Yankee Trails (Hospitality & Tourism, 96GB), and Bertie County Public Schools (Education, 50GB). The data types specified (customer details, payroll, student information including GPAs and IEPs) are highly sensitive, aligning with Qilin’s known double extortion strategy and targeting of critical sectors.⁵
• SAFEPAY listed five victims, four in Germany and one in the UK: Stadt Heilbronn (Government Administration, 85GB), Kellermann & Engelhardt ITEC GmbH (Building and construction, 70GB), Heinrich + Steinhardt GmbH (Architecture & Planning, 49GB), Helix Tool (UK, Manufacturing, 239GB), and Hurst + Schröder GmbH (Germany, Manufacturing, 239GB). The concentration of German victims, particularly in manufacturing and related fields, might indicate a specific campaign focus or affiliate preference. SAFEPAY is known for its aggressive, short ransom deadlines (3-4 days mentioned in claims), designed to pressure victims into quick payment.⁷
• Space Bears claimed two victims: Evertech Instrumental Co., Ltd. (ETI) (Taiwan, Electrical & Electronic Manufacturing) and Viñuelas Abogados (Spain, Law Practice & Law Firms). They alleged compromise of databases, financial documents, and personal information, with publication threatened in 6-8 days. This aligns with their focus on enterprises and use of double extortion.⁹
• DragonForce claimed two US victims: City of Grove (Government Administration, 78.92GB) and Iris ID Systems Inc (Information Technology Services, 204.66GB), with data publication threatened in 5-6 days. This demonstrates their global reach and targeting beyond initial geopolitical motivations.¹²
• MEDUSA claimed Lithium Americas Corp. (Canada, Mining/Metals) as a victim, threatening data publication in 8-9 days and providing sample screenshots. This fits their pattern of targeting large organizations in critical sectors using double extortion.¹⁰
• RALord, a relatively new group ¹¹, claimed Bio-Clima Service Srl (Italy, Medical Equipment Manufacturing) with 50GB of data allegedly exfiltrated and a 7-8 day deadline. This adds another European victim to their early, likely opportunistic, targeting.¹¹

The diversity of active groups, many operating under a Ransomware-as-a-Service (RaaS) model ⁵, fuels this widespread threat. The consistent claims of specific, sensitive data theft (financial records, PII, intellectual property, student/client data) across nearly all ransomware incidents confirm that data exfiltration is integral to the modern ransomware playbook, used to exert maximum pressure beyond mere operational disruption from encryption.⁵

• Initial Access & Alert:
  Incidents related to the cybercrime supply chain were also observed. The threat actor ‘cryptoday’ advertised the sale of administrative access to an unidentified US organization’s WordPress WooCommerce shop via the exploit[.]in forum. Such access provides a direct pathway for financial fraud, data theft, or deployment of further malware like ransomware onto e-commerce platforms. Another actor, ‘Xirosina’, advertised corporate access checker and brute-force software on the same forum, designed to target common enterprise entry points like VPNs, ADFS, Citrix, CPanel, RDWeb, and OWA, with features like proxy support to evade detection. This highlights the market for tools that automate the initial stages of network compromise. Additionally, the hacktivist group SECT0R16, reportedly aided by OverFlame, claimed access to the heating system of Palazzo Raja in Italy. While seemingly minor, this claim aligns with SECT0R16’s documented focus on Operational Technology (OT) and Industrial Control Systems (ICS), potentially representing a demonstration of capability or an opportunistic intrusion into building automation systems.19 These incidents underscore the importance of the underground market in providing the access and tools that enable larger-scale attacks.

Victim Analysis

• Geographic Distribution: The geographic spread of victims on April 17 reflects the different motivations driving threat activity. DDoS attacks were heavily concentrated in Ukraine and Poland, directly linked to the geopolitical activities of NoName057(16).¹ Hungary and Bangladesh also experienced DDoS attacks from Al Ahad and NATION OF SAVIORS respectively. Ransomware victims were more globally distributed, with a significant number in the USA (targeted by Sarcoma, Qilin, DragonForce). European nations including Germany (SAFEPAY), Italy (Sarcoma, RALord, SECT0R16 claim), the UK (Sarcoma, SAFEPAY), and Spain (Space Bears) were also hit. Taiwan (Sarcoma, Space Bears) and Canada (MEDUSA) rounded out the ransomware victim list. This pattern suggests geopolitical factors dictate DDoS targeting, while financial motives drive ransomware groups to target organizations across developed economies perceived as having the capacity to pay ransoms.
• Targeted Industry Sectors: A wide range of industries were impacted. Government Administration was heavily targeted by DDoS (Ukraine, Poland) and also ransomware (USA, Germany). Manufacturing was a prominent target for both DDoS (Ukraine, Poland) and ransomware (USA, Germany, UK, Taiwan, Italy), including sub-sectors like Chemical Manufacturing, Defense & Space, Electrical & Electronic Manufacturing, and Medical Equipment Manufacturing. Aviation & Aerospace (Ukraine, Hungary) and Financial Services/Banking (Poland, UK) were also hit by DDoS and ransomware respectively. Other impacted sectors included IT Services (USA), Education (USA), Real Estate (USA), Hospitality & Tourism (USA, Bangladesh), Transportation & Logistics (Italy), Facilities Services (USA), Arts & Crafts (Taiwan), Law Practice (Spain), Mining/Metals (Canada), Building and Construction (Germany), Architecture & Planning (Germany), Social Media (USA), and Cosmetics (Bangladesh). The targeting of government, defense, and critical manufacturing aligns with strategic disruption goals often seen in geopolitical conflicts. The broad range of sectors hit by ransomware indicates largely opportunistic targeting driven by financial motives, focusing on organizations across various industries based on vulnerability assessments and perceived ability to pay, rather than a strict industry focus for most groups.

Threat Actor Communication & Operations Platforms

The platforms used by threat actors on April 17 align closely with their operational needs and objectives:

• Telegram: This platform was the primary communication channel for hacktivist groups observed in the dataset, including NoName057(16), NATION OF SAVIORS, Al Ahad, and SECT0R16. They used it to publicly claim responsibility for attacks, disseminate propaganda, share proof-of-downtime links (check-host.net reports), and potentially coordinate activities.¹ The continued reliance on Telegram, even by groups like Al Ahad who previously announced intentions to migrate due to privacy concerns ¹⁷, underscores its effectiveness for reaching audiences and maintaining operational tempo within the hacktivist community.¹⁷
• Tor Network: The Tor network was exclusively used by the ransomware groups (Sarcoma, Qilin, SAFEPAY, Space Bears, DragonForce, MEDUSA, RALord) to host their Data Leak Sites (DLS) and potentially for negotiation portals. This provides the necessary anonymity for conducting illicit activities like publishing stolen data and demanding ransom payments.⁵
• Openweb Forums: Specific underground forums accessible on the open web, such as exploit[.]in, served as marketplaces for actors like ‘cryptoday’ and ‘Xirosina’ to advertise and sell compromised initial access credentials and specialized hacking tools.

This clear segmentation of platform usage—public-facing Telegram for hacktivist visibility, anonymized Tor for ransomware infrastructure, and specific forums for illicit commerce—reflects the distinct operational requirements of different types of threat actors.

Table 1: Summary of Observed Incidents (April 17, 2025)

Date (UTC)	Category	Threat Actor	Victim Organization	Victim Country	Victim Industry	Victim Site	Network	Summary / Claim	Published URL	Screenshots
2025-04-17T12:20	DDoS Attack	NoName057(16)	Cesara Telemetry	Ukraine	Aviation & Aerospace	chezara-telemetria.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/588	https://d34iuop8pidsy8.cloudfront.net/be7752b1-0b75-4cc9-a03e-ca739fbfcf5b.png, https://d34iuop8pidsy8.cloudfront.net/2e9ebd72-925e-4fd9-be14-1c187bc5d432.png
2025-04-17T12:13	DDoS Attack	NoName057(16)	Tochprylad	Ukraine	Manufacturing	tochprilad.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/588	https://d34iuop8pidsy8.cloudfront.net/c5b1bda3-5ddf-4510-b76a-e9e205254968.png, https://d34iuop8pidsy8.cloudfront.net/1dfa8992-fd4d-4057-ab00-adb23631fadd.png
2025-04-17T12:13	Ransomware	Sarcoma	Kaye Lifestyle Homes	USA	Real Estate	kayelifestylehomes.com	tor	Claimed 521GB data exfiltrated (Passport IDs, Budget Reports, etc.). Intent to publish in 6-7 days.	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/	https://d34iuop8pidsy8.cloudfront.net/46e0bf31-f64f-4a3e-b82f-4bba8147b028.png, https://d34iuop8pidsy8.cloudfront.net/d8381070-7cea-442d-9695-ffdef48f0a90.png
2025-04-17T12:10	DDoS Attack	NoName057(16)	National Agency of Ukraine on Civil Service	Ukraine	Government Administration	nads.gov.ua	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/588	https://d34iuop8pidsy8.cloudfront.net/3494cde5-c220-4433-a9c2-c4f20baebd4b.png
2025-04-17T12:07	DDoS Attack	NoName057(16)	Athlon Avia	Ukraine	Defense & Space	athlonavia.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/588	https://d34iuop8pidsy8.cloudfront.net/c5d41a3c-a733-4e71-80d4-ea82ec61bd28.png
2025-04-17T12:06	DDoS Attack	NoName057(16)	Sparing-Vist Centre	Ukraine	Government Relations	sparing-vist.ua	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/588	https://d34iuop8pidsy8.cloudfront.net/5bb8d062-e0bf-466a-9bfd-82e0c1e5411c.png, https://d34iuop8pidsy8.cloudfront.net/fbfca9be-4429-4b85-b39a-46bf336870c9.png
2025-04-17T11:00	Ransomware	Qilin	Universal Window and Door LLC	USA	Manufacturing	universalwindow.com	tor	Claimed 35GB data exfiltrated (Customer details, payroll, quotes, etc.).	http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=fd08719c-202e-3d69-9606-f05fae8ba478	https://d34iuop8pidsy8.cloudfront.net/4b71aa4b-c41c-4d63-a61e-3d577e38e9b9.png
2025-04-17T10:41	DDoS Attack	NoName057(16)	Grupa Azoty	Poland	Chemical Manufacturing	grupaazoty.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/27bf3b97-5638-4149-a51a-a3c377284e7e.png, https://d34iuop8pidsy8.cloudfront.net/a0931a17-4ff5-480d-8efe-1462fc906c32.png
2025-04-17T10:35	DDoS Attack	NoName057(16)	Getin Holding	Poland	Financial Services	getin.pl	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/d75f3b00-f5a8-46cb-8681-1a8c516237f6.png, https://d34iuop8pidsy8.cloudfront.net/c097945f-f62f-4395-9079-0e3906aa4e9b.png
2025-04-17T10:31	Ransomware	Qilin	Yankee Trails	USA	Hospitality & Tourism	yankeetrails.com	tor	Claimed 96GB data exfiltrated (Passport, credit card forms, etc.).	http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=81b360b5-1927-3938-89e6-1b7ff0c6c5a3	https://d34iuop8pidsy8.cloudfront.net/4b9508a5-4bfc-4886-b4fe-c0c24f1b94fe.png
2025-04-17T10:29	DDoS Attack	NoName057(16)	Polish Agency for Enterprise Development (PARP)	Poland	Government Administration	en.parp.gov.pl	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/aedd6c30-06c6-48bb-86fb-a9dc71df9182.png, https://d34iuop8pidsy8.cloudfront.net/6ddc128a-80d5-467f-8a8f-3320466aa1b4.png
2025-04-17T10:23	DDoS Attack	NoName057(16)	Przemyśl Municipal Roads Authority	Poland	Government Administration	zdm-przemysl.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/d3f1390d-f437-4dc0-8aba-534b67c410e0.png, https://d34iuop8pidsy8.cloudfront.net/5b79b785-95c0-4b3c-a081-5a0ec9983818.png
2025-04-17T10:20	Ransomware	Qilin	Bertie County Public Schools	USA	Education	bertie.k12.nc.us	tor	Claimed 50GB data exfiltrated (Contracts, student PII, GPA, IEPs, etc.).	http://ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion/site/view?uuid=b8592709-99e2-30a6-95b7-61fd4949837d	https://d34iuop8pidsy8.cloudfront.net/1a0211b7-51b8-4cd0-b783-2f9b1fe74a47.png
2025-04-17T10:12	DDoS Attack	NoName057(16)	PESA Bydgoszcz SA.	Poland	Manufacturing	pesa.pl	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/13ea9e96-dbd0-497f-bdcd-6c50f0ce6b84.png, https://d34iuop8pidsy8.cloudfront.net/f6197152-eea2-4733-89ca-99106ec24e3c.png
2025-04-17T09:56	DDoS Attack	NoName057(16)	Sklep Grupa Azoty	Poland	Chemical Manufacturing	sklep.grupaazoty.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/f5b7d786-6e8e-48ef-a664-11b42c5a6622.png
2025-04-17T09:52	DDoS Attack	NoName057(16)	Grupa Azoty Puławy	Poland	Chemical Manufacturing	pulawy.grupaazoty.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/6d27caa2-a568-49cc-b830-d2041872604e.png
2025-04-17T09:45	DDoS Attack	NoName057(16)	Inwestor Grupa Azoty	Poland	Chemical Manufacturing	inwestor.grupaazoty.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/nnm05716rus/585	https://d34iuop8pidsy8.cloudfront.net/931aa8a2-41c6-42da-8c93-099610863cfc.png
2025-04-17T09:42	Ransomware	Sarcoma	Tralfo	Italy	Transportation & Logistics	tralfo.com	tor	Claimed 34GB data exfiltrated (ID cards, transport confirmations, etc.). Intent to publish in 6-7 days.	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/	https://d34iuop8pidsy8.cloudfront.net/85bdeaa8-9584-41da-b839-778e8752a02f.png
2025-04-17T09:41	Ransomware	Sarcoma	Manchester Credit Union Limited	UK	Banking & Mortgage	manchestercreditunion.co.uk	tor	Claimed 6GB data exfiltrated (IDs, financial reports, PII, etc.). Intent to publish in 7-8 days.	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/	https://d34iuop8pidsy8.cloudfront.net/772e350a-39b0-414d-8a9e-c5b49a7def62.png
2025-04-17T09:22	Ransomware	Sarcoma	Schultz Industries, Inc.	USA	Facilities Services	schultzindustries.com	tor	Claimed 61GB data exfiltrated (Claim/payment info, etc.). Intent to publish in 6-7 days.	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/	https://d34iuop8pidsy8.cloudfront.net/30531888-d6e0-43b4-8cfa-57458008c7ca.png
2025-04-17T08:47	Ransomware	Sarcoma	Ju Percussion Group Foundation	Taiwan	Arts & Crafts	jpg.org.tw	tor	Claimed 1.6TB data exfiltrated (National IDs, insurance reports, PII, etc.). Intent to publish in 8-9 days.	http://sarcomawmawlhov7o5mdhz4eszxxlkyaoiyiy2b5iwxnds2dmb4jakad.onion/	https://d34iuop8pidsy8.cloudfront.net/a8bc4acf-2fcf-4f99-85a6-f03eff212adf.png
2025-04-17T06:13	Initial Access	cryptoday	Unidentified USA Organization	USA	Not specified	Not specified	openweb	Claimed sale of admin WP WooCommerce shop access.	https://forum.exploit.in/topic/257546/	https://d34iuop8pidsy8.cloudfront.net/2b8c1073-0212-4713-abb7-62bf4960d84c.png
2025-04-17T06:10	DDoS Attack	NATION OF SAVIORS	Dhaka luxury spa	Bangladesh	Hospitality & Tourism	dhakaluxuryspa.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/c/2259100562/275	https://d34iuop8pidsy8.cloudfront.net/aa9d06e0-e54e-4498-be70-643efa6dc24e.jpg
2025-04-17T06:10	DDoS Attack	NATION OF SAVIORS	Novla thai spa	Bangladesh	Hospitality & Tourism	novlathaispa.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/c/2259100562/275	https://d34iuop8pidsy8.cloudfront.net/3ccd0c00-f2fb-49f9-8013-57bce6809991.jpg
2025-04-17T06:10	DDoS Attack	NATION OF SAVIORS	Allure Spa Premium	Bangladesh	Cosmetics	allurespabd.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/c/2259100562/275	https://d34iuop8pidsy8.cloudfront.net/b16fb9a4-bf5f-4df8-be92-9a83870517b5.png
2025-04-17T06:09	DDoS Attack	NATION OF SAVIORS	Neha Thai Spa	Bangladesh	Cosmetics	nehathaispa.com	telegram	Claimed DDoS attack, provided proof link.	https://t.me/c/2259100562/275	https://d34iuop8pidsy8.cloudfront.net/83f62ce0-cf8e-4c14-8fa2-97cfca0f9701.png
2025-04-17T05:25	Alert	Xirosina	Not applicable	N/A	N/A	N/A	openweb	Claimed sale of corporate access checker/brute-force software (VPNs, Web Panels, OWA).	https://forum.exploit.in/topic/257544/	https://d34iuop8pidsy8.cloudfront.net/5ac22bdb-c34c-4e9a-8530-6f85f8f97886.png
2025-04-17T05:23	Ransomware	Space Bears	Evertech Instrumental Co., Ltd. (ETI)	Taiwan	Electrical & Electronic Mfg.	en.evertech.com.tw	tor	Claimed compromise, obtaining databases, financial docs, PII. Intent to publish in 6-7 days.	http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/companies/69/evertech-instrumental-co-ltd	https://d34iuop8pidsy8.cloudfront.net/60c111e9-0b56-425e-b458-a82d00d0c9eb.png
2025-04-17T04:03	DDoS Attack	Al Ahad	4chan	USA	Social Media & Online Networking	4chan.org	telegram	Claimed DDoS attack, provided proof link.	https://t.me/qayzerowns/111	https://d34iuop8pidsy8.cloudfront.net/f6c2d4e1-97cc-47f9-9b6d-a5638d1d1064.png, https://d34iuop8pidsy8.cloudfront.net/276cb26a-8d51-4e97-ae22-e09667cf7c7c.png
2025-04-17T03:10	DDoS Attack	Al Ahad	Győr-Pér International Airport	Hungary	Airlines & Aviation	gyor-perairport.hu	telegram	Claimed DDoS attack, provided proof link.	https://t.me/qayzerowns/109	https://d34iuop8pidsy8.cloudfront.net/1347cf73-e8fc-4d78-b77e-1390b888926e.png
2025-04-17T03:03	DDoS Attack	Al Ahad	Budapest Airport	Hungary	Aviation & Aerospace	bud.hu	telegram	Claimed DDoS attack, provided proof link.	https://t.me/qayzerowns/109	https://d34iuop8pidsy8.cloudfront.net/fc14fc41-a70f-4ca8-84dc-6c137865b0ff.png
2025-04-17T02:59	Ransomware	RALord	Bio-Clima Service Srl	Italy	Medical Equipment Manufacturing	bioclimaservice.it	tor	Claimed 50GB data exfiltrated. Intent to publish in 7-8 days.	http://ralord3htj7v2dkavss2hjzviviwgsf4anfdnihn5qcjl6eb5if3cuqd.onion/bioclimaservice/	https://d34iuop8pidsy8.cloudfront.net/01866048-defb-42fb-8144-ba27b7fd31d9.png
2025-04-17T02:42	Initial Access	SECT0R16 (OverFlame)	Palazzo Raja	Italy	Events Services	palazzoraja.com	telegram	Claimed access to heating system.	https://t.me/SECTOR1616/80	https://d34iuop8pidsy8.cloudfront.net/c7db24bd-d8cb-4d71-84a3-920a847e3e8d.png
2025-04-17T02:22	Ransomware	Space Bears	Viñuelas Abogados	Spain	Law Practice & Law Firms	viñuelasabogados.es	tor	Claimed compromise, obtaining client legal info, financial docs, PII. Intent to publish in 7-8 days.	http://5butbkrljkaorg5maepuca25oma7eiwo6a2rlhvkblb4v6mf3ki2ovid.onion/companies/68/vinuelas-abogados	https://d34iuop8pidsy8.cloudfront.net/af37a5e3-2e31-4dff-9c0c-178d40ab9916.png
2025-04-17T01:49	Ransomware	DragonForce	City of Grove	USA	Government Administration	cityofgroveok.gov	tor	Claimed 78.92GB data exfiltrated. Intent to publish in 5-6 days.	http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog	https://d34iuop8pidsy8.cloudfront.net/029c1e7a-3bbd-4a17-8f69-fb67a605d2bd.png
2025-04-17T01:44	Ransomware	DragonForce	Iris ID Systems Inc	USA	Information Technology (IT) Services	irisid.com	tor	Claimed 204.66GB data exfiltrated. Intent to publish in 5-6 days.	http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/blog	https://d34iuop8pidsy8.cloudfront.net/540734b6-dcc0-4abf-afbb-6a87c09a7460.png
2025-04-17T01:25	Ransomware	MEDUSA	Lithium Americas Corp.	Canada	Mining/Metals	lithiumamericas.com	tor	Claimed compromise, data obtained (volume unspecified). Intent to publish in 8-9 days. Sample screenshots available.	http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/detail?id=dd71a1d456e3d42c9c8c57a250c12f22	https://d34iuop8pidsy8.cloudfront.net/eee48941-85a7-469b-a997-3a3a3b038362.png
2025-04-17T01:22	Ransomware	SAFEPAY	Stadt Heilbronn	Germany	Government Administration	heilbronn.de	tor	Claimed 85GB data exfiltrated. Intent to publish in 3-4 days.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#heilbronn	https://d34iuop8pidsy8.cloudfront.net/7cf32e94-4e71-4475-86a3-47a35bc005cb.png
2025-04-17T01:16	Ransomware	SAFEPAY	Kellermann & Engelhardt ITEC GmbH	Germany	Building and construction	itec-gmbh.com	tor	Claimed 70GB data exfiltrated. (No publication timeline mentioned in input).	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#itec	https://d34iuop8pidsy8.cloudfront.net/c1054547-b95e-46c8-84c5-5ae525ebfbd8.png
2025-04-17T01:02	Ransomware	SAFEPAY	Heinrich + Steinhardt GmbH	Germany	Architecture & Planning	heinrich-steinhardt.de	tor	Claimed 49GB data exfiltrated. Intent to publish in 3-4 days.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#heinrich	https://d34iuop8pidsy8.cloudfront.net/67578237-9657-461d-95b1-472ae2fc4e94.png
2025-04-17T00:57	Ransomware	SAFEPAY	Helix Tool	UK	Manufacturing	helixtools.co.uk	tor	Claimed 239GB data exfiltrated. Intent to publish in 3-4 days.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#helixtools	https://d34iuop8pidsy8.cloudfront.net/5663b5b4-9545-471c-b7c2-dc2e3cd14f9f.png
2025-04-17T00:54	Ransomware	SAFEPAY	Hurst + Schröder GmbH	Germany	Manufacturing	hurst-schroeder.de	tor	Claimed 239GB data exfiltrated. Intent to publish in 3-4 days.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#hurst-schroeder	https://d34iuop8pidsy8.cloudfront.net/4372b10d-e570-4bfe-b9a6-d785a470d560.png
2025-04-17T00:46	DDoS Attack	Al Ahad	Government of Hungary	Hungary	Government Administration	kormany.hu	telegram	Claimed DDoS attack, provided proof link.	https://t.me/qayzerowns/108	https://d34iuop8pidsy8.cloudfront.net/7edac5f6-a218-4858-a9f8-bb4992bb78d5.png
2025-04-17T00:21	DDoS Attack	Dark Storm Team	BreachForums	USA	Computer & Network Security	breachforums.st	telegram	Claimed DDoS attack, provided proof links.	https://t.me/DarkStormTeam3/312	https://d34iuop8pidsy8.cloudfront.net/e87d4758-890b-4352-bcea-84710af36255.png
2025-04-17T00:16	Ransomware	SAFEPAY	Extreme Fire Solutions	Australia	Building and construction	extremefire.com.au	tor	Claimed 47GB data exfiltrated.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#extremefire	https://d34iuop8pidsy8.cloudfront.net/841ad567-c496-43a7-903c-eee8d7919b8e.png
2025-04-17T00:13	Ransomware	SAFEPAY	Eichele Bauunternehmung	Germany	Building and construction	eichele-bau.de	tor	Claimed 91GB data exfiltrated.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#eichele	https://d34iuop8pidsy8.cloudfront.net/e878aea0-2403-412b-a781-1b1cc52fbf62.png
2025-04-17T00:13	Ransomware	SAFEPAY	Gebr. Förster GmbH	Germany	Environmental Services	foerster-schwanau.de	tor	Claimed 15GB data exfiltrated.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#frapack	https://d34iuop8pidsy8.cloudfront.net/6d76119a-419b-4aa7-a317-80f3f0872518.jpg
2025-04-17T00:13	Ransomware	SAFEPAY	FRAPACK GmbH	Germany	Transportation & Logistics	frapack.de	tor	Claimed 50GB data exfiltrated.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#foerster	https://d34iuop8pidsy8.cloudfront.net/e63053e9-e5bd-4f49-b1a5-a8514d99df4a.jpg
2025-04-17T00:05	Ransomware	SAFEPAY	Gemeinde Kirkel	Germany	Government Administration	kirkel.de	tor	Claimed 75 GB data exfiltrated.	http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion/#kirkel	https://d34iuop8pidsy8.cloudfront.net/67694e8b-d6f5-4d63-8bdf-6bc02de4ecc2.png

4. Threat Actor Spotlight

Understanding the specific actors behind cyber threats is crucial for effective defense. This section profiles the key threat actors identified in the April 17, 2025 incident data and supported by the available research, detailing their likely motivations, operational methods, and observed activities.

Hacktivist Groups

Hacktivist groups leverage cyberattacks, primarily DDoS, to promote political, ideological, or social agendas. Their operations often coincide with real-world events and conflicts.

• NoName057(16):

• Profile: A prominent pro-Russian hacktivist group that emerged in March 2022 following Russia’s invasion of Ukraine.¹ Their primary motivation is geopolitical, aiming to disrupt and destabilize Ukraine and NATO member states or other countries perceived as supporting Ukraine.¹ They operate with the goal of silencing anti-Russian narratives and undermining support networks for Ukraine.¹ The group may collaborate with others, such as the People’s Cyber Army (PCA), within broader pro-Russian cyber coalitions like CARRtel.²¹
• TTPs: NoName057(16) specializes in DDoS attacks. They developed and utilize a custom tool named “DDoSia,” a multi-threaded application designed to overwhelm target websites with network requests.¹ To amplify their attacks, they build botnets by infecting servers with the Bobik malware, often distributed via the RedLine Stealer.¹ Telegram serves as their central hub for communication, coordination, claiming responsibility for attacks, recruiting volunteers, and disseminating propaganda to tens of thousands of subscribers.¹ They have also used GitHub to host their DDoS tool and related resources.²² While primarily focused on DDoS, they have occasionally employed other tactics like phishing websites.¹ Reports suggest a success rate of around 40% for their attacks, indicating a notable level of effectiveness.¹
• Observed Activity (Apr 17): This group was highly active, claiming responsibility for numerous DDoS attacks targeting a wide array of Ukrainian and Polish organizations. The victims spanned government agencies, defense contractors, manufacturers (including chemical and transport equipment), financial institutions, and aviation services. This activity aligns perfectly with their established modus operandi and geopolitical objectives, demonstrating a sustained and focused campaign against key Ukrainian entities and Polish supporters. Their ability to hit diverse sectors suggests a capacity for target identification and sustained operational tempo, making them a persistent disruptive threat, particularly to nations opposing Russian interests.
• Al Ahad:

• Profile: An Iraqi hacktivist group with a stated anti-Israeli and pro-Palestinian ideology.¹⁷ They target entities perceived as supporting Israel or Western interests.¹⁶ They may operate within larger alliances of ideologically aligned hacktivist groups, such as the Holy League, which unites pro-Palestinian and pro-Russian actors.¹⁸
• TTPs: Their primary tactic appears to be DDoS attacks.¹⁶ They utilize Telegram for communication and attack claims. Despite announcing a planned migration to Signal in late 2024 due to Telegram’s policy changes regarding cooperation with law enforcement, the group maintained an active presence on Telegram under a modified name (“Al Ahad Security”), reposting information about pro-Palestinian cyber activities.¹⁷ This decision likely reflects the importance of Telegram’s large audience and established communication channels for hacktivist operations, which can outweigh platform-related security or privacy concerns for groups prioritizing visibility and recruitment.¹⁷
• Observed Activity (Apr 17): Claimed DDoS attacks against the US-based imageboard 4chan and two international airports in Hungary (Budapest and Győr-Pér). The targeting aligns with a broad anti-Western stance, hitting a prominent US online platform and critical infrastructure (airports) in an EU/NATO member state.
• NATION OF SAVIORS:

• Profile: Limited information is available for this group beyond the April 17 incidents. Based on their name and use of DDoS tactics claimed via Telegram, they fit the general profile of a hacktivist group.
• TTPs: Conducted DDoS attacks, using check-host.net links as proof, and announced activities on Telegram.
• Observed Activity (Apr 17): Targeted four specific commercial establishments (spas) in Dhaka, Bangladesh. This targeting is atypical compared to the geopolitical or large-scale critical infrastructure targets usually associated with prominent international hacktivist campaigns.² This suggests their motivations might be localized (e.g., related to social or religious issues within Bangladesh) or that they are a smaller, less strategically focused group engaging in opportunistic disruption. Further monitoring is necessary to determine their specific ideology and scope.
• SECT0R16:

• Profile: A hacktivist group that emerged around January 2025, potentially with Russian links.¹⁹ Their stated motivations include exposing abuses of power and corruption, with operational focus suggesting geopolitical aims against US oil infrastructure and potentially broader opposition to major powers (US, EU, Russia).¹⁹ They emphasize targeting critical infrastructure, particularly OT/ICS environments.
• TTPs: Known for employing advanced techniques targeting SCADA systems and control panels, particularly in the oil, gas, and water sectors.¹⁹ Their methods include vulnerability exploitation, social engineering, manipulation of control interfaces, and data exfiltration. They operate collaboratively, with known alliances with Z-Pentest and OverFlame, enhancing their capabilities.¹⁹ They utilize Telegram, YouTube, and darknet forums for communication and employ sophisticated psychological manipulation and social engineering tactics in their operations and recruitment.¹⁹
• Observed Activity (Apr 17): Claimed initial access to the heating system of Palazzo Raja, an events venue in Italy, stating the operation was aided by OverFlame. This claim, targeting a building automation system (related to OT/ICS), aligns with their documented focus on control systems, even if the target itself is not traditional critical infrastructure. It may serve as a demonstration of capability or an opportunistic target. The collaboration with OverFlame is consistent with their reported alliances.¹⁹

Ransomware Operations

Ransomware groups primarily operate for financial gain, employing encryption and data theft to extort victims. Many function under a RaaS model.

• Sarcoma:

• Profile: A ransomware group that surfaced in late 2023 or early 2024.⁶ Their motivation is financial gain through extortion.⁶
• TTPs: Employs a double extortion strategy, claiming significant data exfiltration volumes and threatening publication within relatively short timeframes (typically 6-9 days in the observed incidents). They utilize strong encryption (AES-256 with RSA-4096) and have incorporated fileless execution techniques using legitimate tools like PowerShell and WMI to evade detection.⁶ They target a diverse range of industries and geographical locations.⁶
• Observed Activity (Apr 17): Claimed compromises of five organizations across the USA, Italy, UK, and Taiwan in sectors including Real Estate, Transportation, Banking, Facilities Services, and Arts. The claimed data volumes varied significantly, from 6GB to an exceptionally large 1.6TB. This wide range might reflect diverse victim data holdings or potential exaggeration in claims to increase pressure. Their rapid emergence coupled with sophisticated TTPs suggests experienced operators may be behind this group.⁶
• Qilin (Agenda):

• Profile: A well-established RaaS operation active since July 2022.⁵ The ransomware is written in Go and, more recently, Rust, allowing for cross-platform attacks.⁶ The group has Russian-speaking origins ²⁴ and demands high ransoms.⁵
• TTPs: Offers a highly customizable RaaS platform to affiliates.⁵ Standard TTPs include double extortion, publishing stolen data on a dedicated leak site.⁵ Initial access is gained through compromised RDP, phishing, or exploiting public-facing applications like Veeam Backup & Replication (e.g., CVE-2023-27532).⁵ They establish persistence using scheduled tasks and employ techniques like process injection and defense evasion (e.g., rebooting into Safe Mode).⁵ They target both Windows and Linux systems across critical infrastructure sectors globally.⁵
• Observed Activity (Apr 17): Claimed attacks against three US organizations in Manufacturing, Hospitality & Tourism, and Education. The specific, sensitive data types claimed (customer details, payroll summaries, student PII/academic records) align perfectly with their double extortion model and focus on maximizing leverage through data theft.⁵
• SAFEPAY:

• Profile: Active since October 2024.⁸ They claim not to operate as a RaaS, suggesting a potentially closed or private group.⁸ Their motivation is purely financial.⁸
• TTPs: Known to gain initial access by exploiting exposed RDP endpoints.⁷ They employ sophisticated defense evasion techniques using LOLBins (e.g., SystemSettingsAdminFlows.exe to disable Windows Defender) and custom scripts (ShareFinder.ps1 for network reconnaissance).⁷ Privilege escalation is achieved via UAC bypass techniques involving COM object abuse, similar to LockBit.⁷ They actively terminate security processes and critical services (databases, backups, antivirus) to facilitate encryption and hinder recovery.⁷ They practice double extortion, notable for imposing very short deadlines (3-4 days observed) for data publication.⁸ Encrypted files receive a .safepay extension.⁷
• Observed Activity (Apr 17): Claimed five victims, predominantly in Germany (4) and one in the UK. Targets included government, construction, architecture, and manufacturing sectors. The geographic clustering and short deadlines suggest a potentially focused campaign designed for rapid pressure and payout. Their denial of being a RaaS group, despite sophisticated TTPs and multiple victims, warrants further investigation into their structure.⁸
• Space Bears:

• Profile: A newer ransomware group, emerging in early 2024.⁹ They are reportedly aligned with the established Phobos RaaS platform ²⁶ and are believed to operate from Moscow.²⁶
• TTPs: Target both Windows and Linux environments.⁹ Initial access vectors include exploiting RDP vulnerabilities, phishing emails, and software supply chain compromises.⁹ They employ double extortion tactics and may threaten DDoS attacks against non-compliant victims.⁹ A distinguishing feature is their use of a “corporate” styled data leak site, presenting a more professional facade than typical ransomware groups.⁹ They primarily target large enterprises and critical infrastructure.⁹
• Observed Activity (Apr 17): Claimed compromises of a Taiwanese electronics manufacturer (Evertech Instrumental) and a Spanish law firm (Viñuelas Abogados). These targets fit their focus on enterprise victims. The unique corporate branding might be an attempt to differentiate themselves within the broader Phobos RaaS ecosystem or a specific psychological tactic.²⁷
• DragonForce:

• Profile: Originating from Malaysia, this group initially engaged in hacktivism (pro-Palestinian) before evolving into a RaaS operation in late 2023.²⁸ While potentially retaining some ideological roots, their current operations appear primarily financially driven. They actively recruit affiliates via forums like RAMP, offering a high commission rate (up to 80%).²⁹
• TTPs: Operates a RaaS supporting Windows, Linux, and ESXi environments.¹² They possess a notably advanced and flexible payload builder for affiliates.¹² Initial access is gained through phishing or exploiting vulnerabilities in RDP and VPN solutions, including specific CVEs like CVE-2021-44228 (Log4Shell), CVE-2023-46805/CVE-2024-21887 (Ivanti), and CVE-2024-21412 (Windows Defender bypass).¹² They practice dual extortion and employ aggressive tactics, such as publishing audio recordings of ransom negotiations on their dark web DLS.¹² Their DLS also features advanced CAPTCHA mechanisms to hinder automated tracking.²⁹ They target organizations globally, with notable activity in the Middle East (Saudi Arabia).²⁹
• Observed Activity (Apr 17): Claimed attacks against a US city government (City of Grove) and a US IT services company (Iris ID Systems). These targets demonstrate their continued global operations targeting diverse sectors. Their use of unique pressure tactics and sophisticated tooling highlights their focus on maximizing extortion success through their RaaS platform.
• MEDUSA:

• Profile: A long-standing RaaS operation, active since June 2021.¹⁰ By early 2025, they had impacted over 300 victims across critical infrastructure sectors.¹³ While operating an affiliate model, core functions like ransom negotiation remain centrally controlled by the developers.¹⁰ Their motivation is financial.
• TTPs: Known for double extortion and potentially triple extortion tactics (demanding further payment after an initial ransom).¹⁰ They recruit Initial Access Brokers (IABs).¹⁰ Initial access is gained via phishing or exploiting vulnerabilities like CVE-2024-1709 (ConnectWise ScreenConnect) and CVE-2023-48788 (Fortinet EMS).¹⁰ They heavily utilize Living-off-the-Land (LOTL) techniques (PowerShell, WMI, certutil) and legitimate remote access tools (AnyDesk, ConnectWise, Splashtop, etc.) for stealth and evasion.¹⁰ Defense evasion includes script obfuscation and attempts to disable EDR using vulnerable drivers (BYOVD).¹⁰ Data exfiltration often uses Rclone.¹⁰ Their encryptor is typically named gaze.exe, and encrypted files get a .medusa extension.¹⁰
• Observed Activity (Apr 17): Claimed compromise of Lithium Americas Corp., a Canadian mining company. This targeting of a major industrial entity aligns with their history of hitting critical sectors. Their longevity and high victim count attest to the effectiveness of their stealth-focused TTPs, particularly the abuse of legitimate tools.¹⁰
• RALord:

• Profile: A very new RaaS group that emerged in late March 2025.¹¹ Their ransomware is reportedly Rust-based.³¹ They offer a high affiliate commission (85%).¹¹ There are potential, unconfirmed links to the older RAWorld/RAGroup.¹¹ Motivation is financial.
• TTPs: Operates a RaaS model where affiliates likely provide initial access.¹¹ Their DLS is written in Russian and English and uses countdown timers to pressure victims.¹¹ They accept various payment methods (crypto, possibly bank transfer) and offer escrow services.¹¹ Unusually, they also offer their encryption tool for sale separately from the full RaaS program.¹¹ Encrypted files have the .RALord extension.³¹ Initial victims were located in South America and Europe.¹¹
• Observed Activity (Apr 17): Claimed compromise of Bio-Clima Service Srl, an Italian medical equipment manufacturer. This adds another European target to their early victim list, likely reflecting opportunistic targeting as they establish their operation. Their use of Rust aligns with modern ransomware development trends aimed at performance and evasion.³¹ The flexible RaaS structure aims to attract affiliates quickly in a competitive market.¹¹

Initial Access & Tool Vendors

These actors facilitate cybercrime by providing the necessary entry points or tools for other attackers.

• cryptoday:

• Profile: An actor observed operating on the exploit[.]in underground forum. Their moniker might suggest an interest or involvement in cryptocurrency-related activities.³²
• TTPs/Activity (Apr 17): Offered administrative access credentials for a WordPress WooCommerce online shop belonging to an unidentified US organization.
• Significance: This activity directly supplies high-privilege access to e-commerce platforms, which are valuable targets for financial fraud, payment card skimming, customer data theft, and ransomware deployment. It exemplifies the specialized market for specific types of initial access.
• Xirosina:

• Profile: An actor observed operating on the exploit[.]in underground forum.
• TTPs/Activity (Apr 17): Advertised the sale of software designed for checking corporate access credentials and performing brute-force attacks. The tool targets common enterprise perimeter services, including VPNs, ADFS, Citrix, CPanel, RDWeb, and Outlook Web App (OWA). It reportedly includes support for using proxies to obfuscate the attacker’s origin and evade detection.
• Significance: This highlights the availability of specialized, automated tools that lower the barrier for conducting widespread initial access attempts against common corporate infrastructure components. The focus on frequently targeted services ⁵ and the inclusion of evasion features (proxy support) indicate a tool designed to facilitate the critical first stage of many network intrusions.

Table 2: Threat Actor Overview (Observed April 17, 2025)

Threat Actor	Type	Primary Motivation(s)	Key TTPs	Primary Targets (Observed/Reported)	Communication Platform(s)	Notable Characteristics
NoName057(16)	Hacktivist	Geopolitical (Pro-Russian)	DDoS (DDoSia tool, Bobik botnet), Telegram coordination, GitHub hosting 1	Ukraine, Poland (Govt, Defense, Mfg, Finance, Aviation) 1	Telegram, GitHub	High volume DDoS, strong geopolitical alignment, ~40% success rate.1
Al Ahad	Hacktivist	Geopolitical (Pro-Palestine)	DDoS, Telegram coordination (maintained despite Signal move attempt) 16	USA (Social Media), Hungary (Airports) 16	Telegram (Signal attempted)	Part of anti-Israel/anti-Western hacktivist ecosystem.16
NATION OF SAVIORS	Hacktivist	Unclear (Potentially Local)	DDoS, Telegram claims	Bangladesh (Hospitality, Cosmetics)	Telegram	Atypical targeting (local commercial) compared to major geopolitical groups.
SECT0R16	Hacktivist	Geopolitical/Anti-Corruption	Advanced OT/ICS targeting (SCADA), Vuln exploit, Social Eng, Alliances (Z-Pentest, OverFlame) 19	Italy (Building Control – claimed), US/NL (Oil/Water reported) 19	Telegram, Dark Forums	Focus on critical infrastructure control systems, psychological manipulation tactics.19
Sarcoma	Ransomware	Financial	Double Extortion, Large data claims (up to 1.6TB), Short timelines, AES/RSA encryption, Fileless exec 6	USA, Italy, UK, Taiwan (Real Estate, Transport, Banking, Facilities, Arts)	Tor	Rapid emergence, sophisticated TTPs, aggressive extortion.6
Qilin (Agenda)	Ransomware (RaaS)	Financial	Customizable RaaS, Double Extortion, RDP/Phishing/Vuln access (CVE-2023-27532), Evasion (Safe Mode) 5	USA (Mfg, Hospitality, Education), Global Critical Infra 5	Tor	Go/Rust based, Russian-speaking origins, targets Windows/Linux.5
SAFEPAY	Ransomware	Financial	Double Extortion, RDP access, LOLBins/Scripting evasion, UAC Bypass, Process Termination, Short deadlines 7	Germany, UK (Govt, Construction, Architecture, Mfg) 7	Tor	Claims not RaaS 8, sophisticated TTPs, very short (3-4 day) deadlines.
Space Bears	Ransomware (RaaS)	Financial	Double Extortion, RDP/Phishing/Supply Chain access, Potential DDoS threat, Phobos RaaS aligned 9	Taiwan, Spain (Electronics Mfg, Law), Large Enterprises/Infra 9	Tor	Moscow-based (alleged) 26, unique “corporate” leak site branding.9
DragonForce	Ransomware (RaaS)	Financial (Ex-Hacktivist?)	Advanced RaaS builder, Double Extortion, Phishing/RDP/VPN access (CVEs), Publishes audio, CAPTCHA DLS 12	USA (Govt, IT), Saudi Arabia (Real Estate reported) 29	Tor, RAMP Forum	Malaysian origins 28, high affiliate commission (80%) 12, aggressive/unconventional tactics.12
MEDUSA	Ransomware (RaaS)	Financial	Double/Triple Extortion, IAB recruitment, LOTL/Legit tool abuse, Evasion (BYOVD), Rclone exfil 10	Canada (Mining), Global Critical Infra (>300 victims) 13	Tor	Long active (since 2021), high victim count, stealth focus via LOTL.10
RALord	Ransomware (RaaS)	Financial	New RaaS (Rust), Double Extortion, High commission (85%), Sells tool separately, Escrow option 11	Italy (Medical Mfg), S. America/Europe (initial targets) 11	Tor, Cybercrime Forum	Very recent emergence (Mar 2025), potential RAWorld links.11
cryptoday	Initial Access Vendor	Financial	Selling WP WooCommerce admin access	USA (Unidentified Org)	Openweb Forum (exploit.in)	Provides direct access to valuable e-commerce targets.
Xirosina	Tool Vendor	Financial	Selling Corp Access Checker/Brute-Forcer (VPNs, Web Panels, OWA) with proxy support	Not Applicable	Openweb Forum (exploit.in)	Provides automated tools for initial compromise attempts against common enterprise services.

5. Key Attack Trends and Techniques

Analysis of the incidents from April 17, 2025, reveals several prominent trends and techniques employed by threat actors, reflecting the current state of the cyber threat landscape.

DDoS Campaigns: Geopolitics and Tactics

• Geopolitical Motivation: The overwhelming majority of DDoS attacks observed were directly linked to ongoing geopolitical conflicts. NoName057(16)’s campaign against Ukraine and Poland is a clear example of hacktivism being used as a tool in the Russia-Ukraine war, aiming to disrupt infrastructure and demonstrate opposition.¹ Similarly, Al Ahad’s targeting aligns with pro-Palestinian/anti-Western sentiments often tied to the Israeli-Palestinian conflict.¹⁶ This trend highlights how nation-state conflicts spill over into cyberspace, with non-state actors (or potentially state-sponsored fronts ²) using DDoS as a low-cost, high-visibility weapon.
• Tooling and Coordination: Groups like NoName057(16) utilize custom tools like DDoSia, likely deployed via botnets built using malware such as Bobik.¹ Coordination and target dissemination heavily rely on platforms like Telegram, which enables rapid communication and mobilization of participants within large subscriber bases.¹ The use of public proof-of-downtime services (check-host.net) is standard practice for claiming success.
• Targeting Strategy: DDoS targets are often selected for maximum disruption or symbolic value. Attacks against government websites, financial institutions, and transportation services aim to impede daily life and state functions.¹ Targeting critical infrastructure, including energy and potentially OT/ICS environments ³, represents a more severe escalation. Symbolic targets like media outlets or specific websites (e.g., 4chan) are chosen for propaganda value or to express ideological opposition.
• Hacktivist Alliances: The cyber landscape features collaborations between hacktivist groups. Examples include the CARRtel alliance involving PCA and NoName057(16) ²¹, the Holy League uniting pro-Russian and pro-Palestinian groups ¹⁸, and the partnership between SECT0R16 and OverFlame.²³ These alliances can pool resources, share TTPs, and enable more complex or widespread campaigns.
• Impact and Evolution: While often perceived as less sophisticated than other attack types, DDoS campaigns by groups like NoName057(16) demonstrate significant disruptive potential, achieving reported success rates of around 40%.¹ The trend appears to be shifting from simple website takedowns towards more strategic disruption of essential services, potentially blurring the lines with state-sponsored operations, especially when objectives align.²

Ransomware Modus Operandi

The ransomware incidents observed on April 17 showcase a mature, adaptable, and highly damaging criminal enterprise.

• RaaS Dominance: The Ransomware-as-a-Service model is prevalent, with groups like Qilin, DragonForce, MEDUSA, RALord, and Space Bears (via Phobos alignment) operating affiliate programs.⁵ This model allows core developers to focus on malware development and infrastructure, while affiliates specialize in gaining initial access and deploying the ransomware. High commission rates (e.g., 80-85% for DragonForce, RALord) incentivize affiliate participation.¹¹
• Double/Triple Extortion: This is the standard operating procedure. Attackers first exfiltrate sensitive data before encrypting systems.⁵ The primary leverage then becomes the threat of publishing this stolen data on a public DLS hosted on Tor, rather than solely relying on the need for decryption. Some groups, like MEDUSA, may engage in triple extortion, demanding further payments after an initial ransom.¹⁰ Aggressive tactics are common, including short payment deadlines (SAFEPAY, Sarcoma) and publishing negotiation details (DragonForce).⁸
• Data Exfiltration Focus: The claims made by ransomware groups consistently highlight the theft of specific, high-value data types: Personally Identifiable Information (PII), financial records, customer databases, intellectual property, employee records (including passport IDs), student data (including academic and special needs information), legal documents, and health information. This demonstrates a deliberate focus on acquiring data that maximizes reputational damage, regulatory risk (e.g., GDPR, HIPAA), and operational impact for the victim, thereby increasing the pressure to pay the ransom.
• Initial Access Vectors: Common methods used by ransomware affiliates to breach networks include exploiting vulnerabilities in Remote Desktop Protocol (RDP) ⁷, conducting phishing campaigns to steal credentials ⁵, and exploiting known vulnerabilities (CVEs) in public-facing applications and VPN solutions.⁵ Many RaaS operations rely on Initial Access Brokers (IABs) who specialize in gaining and selling network access.¹⁰
• Evasion Techniques: Ransomware actors continuously refine their techniques to bypass security controls. This includes heavy reliance on Living-off-the-Land (LOTL) techniques, abusing legitimate system tools like PowerShell and WMI.¹⁰ Using legitimate remote administration tools (AnyDesk, ConnectWise, etc.) helps blend malicious activity with normal administrative tasks.¹⁰ Script obfuscation ¹⁰, fileless execution ⁶, UAC bypass techniques ⁷, and actively disabling security software and deleting logs ⁷ are common practices. The adoption of modern programming languages like Rust (used by Qilin, RALord) may also offer advantages in performance and evasion.²⁴
• Infrastructure: The Tor network remains essential for ransomware operations, providing anonymity for hosting DLSs and facilitating communication and negotiation with victims.⁵

The ransomware ecosystem functions as a highly professionalized illicit industry. Specialization (developers, affiliates/IABs, negotiators), continuous technical innovation focused on evasion, and the strategic shift towards data exfiltration as the primary extortion lever make it a formidable and adaptive threat.

Table 3: Ransomware Claims Summary (April 17, 2025)

Threat Actor	Victim Organization	Victim Country	Victim Industry	Claimed Data Volume	Claimed Data Types (Examples)	Publication Deadline (Days from report)
Sarcoma	Kaye Lifestyle Homes	USA	Real Estate	521GB	Employee Passport IDs, Budget Reports, Employment Slips	6-7
Sarcoma	Tralfo	Italy	Transportation & Logistics	34GB	ID cards, Transport confirmations	6-7
Sarcoma	Manchester Credit Union Limited	UK	Banking & Mortgage	6GB	IDs, Financial Reports, PII, Membership Applications	7-8
Sarcoma	Schultz Industries, Inc.	USA	Facilities Services	61GB	Claim/Payment info, Loss settlement	6-7
Sarcoma	Ju Percussion Group Foundation	Taiwan	Arts & Crafts	1.6TB	National IDs, Insurance reports, Labor compensation slips	8-9
Qilin	Universal Window and Door LLC	USA	Manufacturing	35GB	Customer details, Shipping addresses, Payroll, Quotes	Not specified
Qilin	Yankee Trails	USA	Hospitality & Tourism	96GB	Passport, Credit card auth forms	Not specified
Qilin	Bertie County Public Schools	USA	Education	50GB	Contracts, Student PII (Name, ID, GPA), Incident reports, IEPs	Not specified
SAFEPAY	Stadt Heilbronn	Germany	Government Administration	85GB	Not specified	3-4
SAFEPAY	Kellermann & Engelhardt ITEC GmbH	Germany	Building and construction	70GB	Not specified	Not specified
SAFEPAY	Heinrich + Steinhardt GmbH	Germany	Architecture & Planning	49GB	Not specified	3-4
SAFEPAY	Helix Tool	UK	Manufacturing	239GB	Not specified	3-4
SAFEPAY	Hurst + Schröder GmbH	Germany	Manufacturing	239GB	Not specified	3-4
Space Bears	Evertech Instrumental Co., Ltd. (ETI)	Taiwan	Electrical & Electronic Mfg.	Not specified	Databases, Financial docs, Employee/Client PII	6-7
Space Bears	Viñuelas Abogados	Spain	Law Practice & Law Firms	Not specified	Client legal info, Financial docs, Employee/Client PII	7-8
DragonForce	City of Grove	USA	Government Administration	78.92GB	Not specified	5-6
DragonForce	Iris ID Systems Inc	USA	Information Technology (IT) Services	204.66GB	Not specified	5-6
MEDUSA	Lithium Americas Corp.	Canada	Mining/Metals	Not specified	Not specified (Sample screenshots available)	8-9
RALord	Bio-Clima Service Srl	Italy	Medical Equipment Manufacturing	50GB	Not specified	7-8

The Market for Illicit Access and Tools

The incidents involving ‘cryptoday’ and ‘Xirosina’ highlight the crucial role of the underground economy that supports and enables cyberattacks.

• Initial Access Brokers (IABs): Actors like ‘cryptoday’ specialize in gaining unauthorized access to networks or specific high-value accounts (like the WP WooCommerce admin access) and then selling that access to other criminals.¹⁰ This creates a supply chain where ransomware groups or other attackers can purchase ready-made entry points, bypassing the often time-consuming reconnaissance and initial exploitation phases.
• Tooling: The availability of specialized software, such as the corporate access checker/brute-forcer advertised by ‘Xirosina’, democratizes attack capabilities. These tools automate common attack techniques like credential stuffing or brute-forcing against prevalent enterprise services (VPNs, webmail, remote access panels), allowing less skilled actors to conduct attacks or enabling sophisticated actors to scale their operations.³³
• Platforms: Underground forums, often accessible via the open web or Tor, serve as marketplaces where IABs and tool vendors connect with buyers. Forums like exploit[.]in are known hubs for this type of illicit commerce.

This readily accessible market for initial access and attack tools acts as a significant force multiplier for cybercrime. It lowers the barrier to entry for aspiring criminals and streamlines operations for established groups, contributing directly to the high volume and success rate of attacks like ransomware.

6. Concluding Remarks and Strategic Outlook

Synthesis of Findings

The cyber threat landscape, as exemplified by the activity on April 17, 2025, remains volatile and multifaceted. Key observations include:

1. Geopolitically Motivated DDoS: Hacktivist groups, notably NoName057(16), continue to leverage DDoS attacks as a primary tool for disruption and protest, closely aligning their campaigns with real-world conflicts like the Russia-Ukraine war.
2. Diverse and Sophisticated Ransomware: The ransomware ecosystem is characterized by numerous active groups employing the RaaS model and standardized double extortion tactics. These groups demonstrate continuous evolution in their TTPs, focusing on stealth, evasion, and maximizing pressure through data theft.
3. Critical Role of Underground Markets: The availability of initial access credentials and specialized attack tools on underground forums significantly enables and accelerates cybercrime operations, particularly ransomware.
4. Platform Specialization: Threat actors utilize specific platforms based on their needs: Telegram for hacktivist communication and coordination, Tor for anonymous ransomware infrastructure, and dedicated forums for illicit trade.

Interconnectedness

These different facets of the threat landscape are often interconnected. IABs provide the crucial first step for many ransomware attacks. Hacktivist groups may form alliances or potentially operate with tacit or direct state support, blurring lines.² Tools developed for one purpose can be repurposed by various actors. Understanding these connections is vital for comprehending the full scope of the threat environment.

Broader Implications

Several broader implications arise from this analysis:

• Blurring Motivations: The traditional distinction between ideologically motivated hacktivists and financially motivated cybercriminals is becoming less clear. Groups like DragonForce evolved from hacktivism to RaaS ²⁸, while others like Dark Storm Team appear to blend political messaging with financial schemes like cryptocurrency promotion.³⁴ This convergence makes actor attribution and predicting future actions more challenging, as motivations may be mixed or shift based on opportunity.
• Growing OT/ICS Risk: The targeting of Operational Technology and Industrial Control Systems, explicitly mentioned in the profile of SECT0R16 ¹⁹ and reflected in broader trends of attacks on critical infrastructure ³, signifies an increasing risk of cyberattacks causing physical disruption. Compromising systems that control physical processes (e.g., energy grids, water treatment ², manufacturing lines, building automation) elevates the potential impact far beyond data loss or financial harm.
• Necessity for Adaptive Defense: The constant evolution of ransomware TTPs—including the heavy use of LOTL techniques ¹³, adoption of newer programming languages like Rust ³¹, rapid exploitation of new CVEs ¹⁰, and sophisticated evasion tactics—renders static, signature-based defenses insufficient. Effective security requires a dynamic, adaptive strategy focused on behavioral analysis, anomaly detection, and proactive threat hunting to identify and counter threats that bypass traditional prevention measures.

Strategic Recommendations

Based on the observed threats and trends, organizations should prioritize the following strategic security measures:

1. DDoS Mitigation:

• Implement comprehensive, multi-layered DDoS protection services capable of absorbing large-volume attacks and filtering malicious traffic. This is especially critical for government, financial services, and critical infrastructure sectors frequently targeted by hacktivists.
• Utilize Web Application Firewalls (WAFs) to protect against application-layer attacks.
• Consider rate limiting, geo-blocking for irrelevant regions, and CAPTCHA challenges for public-facing services.¹
• Maintain and regularly test DDoS-specific incident response plans.

2. Ransomware Defense (Multi-Layered Approach):

• Prevention:

• Vulnerability Management: Implement aggressive and timely patching, prioritizing vulnerabilities known to be exploited by ransomware groups (e.g., those affecting VPNs, RDP, common enterprise software).¹⁰
• Secure Remote Access: Harden RDP configurations, enforce strong authentication (MFA), limit exposure, and monitor usage closely. Secure VPN implementations.⁷
• Email Security: Deploy advanced email filtering solutions to detect and block phishing attempts, malicious attachments, and malicious links.⁵
• User Training: Conduct regular security awareness training focusing on phishing identification, credential security, and safe browsing habits.²⁴
• Principle of Least Privilege: Restrict user and service account permissions to the minimum necessary.
• Detection:

• Endpoint Detection and Response (EDR/XDR): Deploy solutions with strong behavioral detection capabilities to identify LOTL techniques, suspicious script execution (PowerShell), process injection, credential dumping (Mimikatz), and unauthorized use of administrative tools (PsExec, remote access software).¹⁰
• Network Monitoring & Segmentation: Monitor internal network traffic for anomalous activity and lateral movement. Implement network segmentation to contain breaches and limit the spread of ransomware.²⁴
• Data Exfiltration Detection: Monitor for large or unusual outbound data transfers, potentially using tools like Rclone.¹⁰
• Response & Recovery:

• Backups: Maintain robust backup strategies with immutable, offline (air-gapped), and regularly tested backups.²⁴ Ensure backup integrity and rapid recovery capabilities.
• Incident Response Plan: Develop and regularly exercise a comprehensive IR plan that specifically addresses ransomware and double extortion scenarios, including legal counsel engagement, data breach notification procedures, public relations strategy, and decision-making regarding ransom payment. Consider establishing a retainer with a professional IR firm.

3. Initial Access Prevention:

• Perimeter Hardening: Secure all internet-facing systems and services.
• Multi-Factor Authentication (MFA): Enforce MFA across all accounts, especially privileged ones and remote access points.
• Credential Security: Implement strong password policies and monitor for credential leaks.
• Threat Intelligence: Monitor underground forums and marketplaces for mentions of company assets or compromised credentials being sold.

4. OT/ICS Security:

• Organizations with OT environments must implement specific security controls, including robust IT/OT network segmentation, OT-specific monitoring and threat detection, vulnerability management tailored for ICS, secure remote access protocols, and physical security measures. Understand TTPs specific to OT environments.¹⁹

5. Continuous Threat Intelligence:

• Maintain awareness of the evolving threat landscape, including active threat actors, their TTPs, targeted vulnerabilities, and sectors/regions of focus. Utilize threat intelligence feeds, participate in information sharing groups (ISACs/ISAOs), and consume regular security reporting.

Forward Look

The convergence of geopolitical tensions and sophisticated cybercrime techniques suggests the current high level of threat activity will likely persist. Expect continued DDoS campaigns linked to global conflicts, potentially increasing in sophistication or targeting impact. Ransomware will remain a dominant threat, with actors further refining evasion techniques, potentially increasing focus on OT environments, and continuing to blur motivational lines by incorporating elements of hacktivism or other illicit activities. The underground markets for access and tools will continue to fuel these threats. Consequently, organizations must prioritize building cyber resilience through adaptive security strategies, robust incident response capabilities, and continuous vigilance informed by actionable threat intelligence.

Works cited

1. Unmasking NoName057(16) – CybelAngel, accessed April 17, 2025, https://cybelangel.com/unmasking-noname05716/
2. Hacktivism Offers Plausible Deniability for State-Backed Cyber Actors – Stratfor, accessed April 17, 2025, https://worldview.stratfor.com/article/hacktivism-offers-plausible-deniability-state-backed-cyber-actors
3. Ransomware, state actors, hacktivists exploited geopolitical tensions to target critical infrastructure in 2024 – Industrial Cyber, accessed April 17, 2025, https://industrialcyber.co/reports/ransomware-state-actors-hacktivists-exploited-geopolitical-tensions-to-target-critical-infrastructure-in-2024/
4. Weekly Top 10: 02.17.2025: DragonRank Seen Exploiting IIS …, accessed April 17, 2025, https://innovatecybersecurity.com/security-threat-advisory/weekly-top-10-02-17-2025-dragonrank-seen-exploiting-iis-servers-across-asia-postgresql-vulnerabilities-used-to-breach-beyondtrust-sarcoma-ransomware-operation-breached-unimicron-and-more/
5. Threat Actor Profile: Qilin Ransomware Group – Cyble, accessed April 17, 2025, https://cyble.com/threat-actor-profiles/qilin-ransomware-group/
6. Weekly Intelligence Report – 11 Apr 2025 – CYFIRMA, accessed April 17, 2025, https://www.cyfirma.com/news/weekly-intelligence-report-11-apr-2025/
7. What is SafePay Ransomware? – Everything You Need to Know …, accessed April 17, 2025, https://redpiranha.net/news/what-is-safepay-ransomware-everything-you-need-know
8. Exclusive: SafePay claims breach of Aussie fire protection services firm – Cyber Daily, accessed April 17, 2025, https://www.cyberdaily.au/security/12003-exclusive-safepay-claims-breach-of-aus-fire-protection-services-firm
9. Space Bears Ransomware Recovery | Solace Cyber, accessed April 17, 2025, https://solacecyber.co.uk/space-bears-ransomware/
10. #StopRansomware: Medusa Ransomware | CISA, accessed April 17, 2025, https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a
11. ARaaStocracy – RALord ransomware emerges with new DLS – CYJAX, accessed April 17, 2025, https://www.cyjax.com/resources/blog/araastocracy-ralord-ransomware-emerges-with-new-dls/
12. DragonForce Ransomware Group is Targeting Saudi … – Resecurity, accessed April 17, 2025, https://www.resecurity.com/blog/article/dragonforce-ransomware-group-is-targeting-saudi-arabia
13. #StopRansomware: Medusa Ransomware – Internet Crime Complaint Center, accessed April 17, 2025, https://www.ic3.gov/CSA/2025/250312.pdf
14. RALord Ransomware | WatchGuard Technologies, accessed April 17, 2025, https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/ralord
15. The Growing Threat Posed by Hacktivist Groups – Searchlight Cyber, accessed April 17, 2025, https://slcyber.io/blog/the-growing-threat-posed-by-hacktivist-groups/
16. Israel ranks second in list of countries targeted by cyberattacks in 2024 — report, accessed April 17, 2025, https://www.timesofisrael.com/israel-ranks-second-in-list-of-countries-targeted-by-cyberattacks-in-2024-report/
17. Three Months After the Storm: Did Cybercriminals Move to Telegram …, accessed April 17, 2025, https://www.kelacyber.com/blog/three-months-after-the-storm-did-cybercriminals-move-to-telegram-alternatives/
18. Holy League: A Unified Threat Against Western Nations, NATO, India and Israel – Radware, accessed April 17, 2025, https://www.radware.com/security/threat-advisories-and-attack-reports/holy-league-a-unified-threat-against-western-nations/
19. Cyber Intelligence Bureau Orange Cyberdefense, accessed April 17, 2025, https://www.orangecyberdefense.com/fileadmin/global/CyberIntelligenceBureau/Gangs_Investigations/Sector16/Sector16Group.pdf
20. The Exodus Began: Alternatives for Telegram – SOCRadar® Cyber Intelligence Inc., accessed April 17, 2025, https://socradar.io/the-exodus-began-alternatives-for-telegram/
21. Peoples Cyber Army Of Russia | Threat Actor Profile – Cyble, accessed April 17, 2025, https://cyble.com/threat-actor-profiles/peoples-cyber-army-of-russia/
22. NoName057(16): Pro-Russian Hacktivist Group – Radware, accessed April 17, 2025, https://www.radware.com/cyberpedia/ddos-attacks/noname057(16)/
23. New Hacktivist Alliance Emerges: OverFlame and SECTOR16 Join Forces – Cyber Press, accessed April 17, 2025, https://cyberpress.org/overflame-sector16-join/
24. Agenda (Qilin) – SentinelOne, accessed April 17, 2025, https://www.sentinelone.com/anthology/agenda-qilin/
25. Qilin Ransomware: Exposing the TTPs Behind One of the Most Active Ransomware Campaigns of 2024 – Picus Security, accessed April 17, 2025, https://www.picussecurity.com/resource/blog/qilin-ransomware
26. Space Bears Ransomware: What You Need To Know – Tripwire, accessed April 17, 2025, https://www.tripwire.com/state-of-security/space-bears-ransomware-what-you-need-know
27. Atos Group Denies Space Bears’ Ransomware Attack Claims – Infosecurity Magazine, accessed April 17, 2025, https://www.infosecurity-magazine.com/news/atos-denies-space-bears-ransomware/
28. DragonForce Ransomware Group: Tactics, Targets & Mitigation – Cyble, accessed April 17, 2025, https://cyble.com/threat-actor-profiles/dragonforce-ransomware-group/
29. DragonForce Ransomware Hits Saudi Firm, 6TB Data Stolen – Infosecurity Magazine, accessed April 17, 2025, https://www.infosecurity-magazine.com/news/6tb-data-stolen-saudi-cyber-attack/
30. Medusa Ransomware Analysis, Simulation, and Mitigation – CISA Alert AA25-071A, accessed April 17, 2025, https://www.picussecurity.com/resource/blog/medusa-ransomware-cisa-alert-aa25-071a
31. RALord Ransomware, accessed April 17, 2025, https://www.broadcom.com/support/security-center/protection-bulletin/ralord-ransomware
32. Threat Actors Merging Malicious Activity With Cryptocurrency Show How the Attack Landscape is Developing in Decentralized Finance – EclecticIQ Blog, accessed April 17, 2025, https://blog.eclecticiq.com/threat-actors-merging-malicious-activity-with-cryptocurrency-show-how-the-attack-landscape-is-developing-in-decentralized-finance
33. What Is A Zero Day Exploit? 0day Attack – Cyble, accessed April 17, 2025, https://cyble.com/knowledge-hub/zero-day-exploit/
34. Dark Storm Team: The Hacker Group Behind the DDoS Attack on X …, accessed April 17, 2025, https://foresiet.com/blog/dark-storm-team-the-hacker-group-behind-the-ddos-attack-on-x-twitter
35. Global Hacktivist Threats – Graphika, accessed April 17, 2025, https://graphika.com/reports/global-hacktivist-threats