KRAKENLABS RESEARCH HIGHLIGHTS 2025: THE SHIFTS THAT REDEFINED THE THREAT LANDSCAPE

Summary from the TLDR InfoSec newsletter

2025's threat landscape evolution was characterized by AI integration into cybercrime workflows, industrialized Crimeware-as-a-Service platforms like Olymp Loader and LabInstalls PPI distribution, and Initial Access Brokers monetizing compromised edge devices, including Belsen Group's sale of 15,000 FortiGate device accesses. The year witnessed a decline in traditional carding fraud under regulatory pressure, while threat actors shifted toward identity abuse and trust exploitation, exemplified by attacks on Salesforce-hosted airline data and on cryptocurrency platforms targeted for geopolitical impact rather than financial gain. Analysis revealed the convergence of ideological hacktivism with ransomware business models, including pro-Palestinian actor zerodayx1's BQTLock RaaS offering and leaked Black Basta chats that exposed operational dynamics, underscoring that basic security failures and third-party risk management remain decisive factors in organizational breach outcomes.