Top Threats - Q1 2025

As we review Q1 2025, we highlight the top malware, tactics, and attacks including infostealers, ransomware, and spyware that kept defenders alert as threat actors grew more aggressive.

Jul 14, 2025

Welcome back to Hall of Hacks Weekly

In our continued coverage of Q1 2025, this week, we spotlight the top malware, tactics, and campaigns that defined the threat landscape. From stealthy infostealers to fast-moving ransomware and newly discovered spyware, defenders were kept on their toes as adversaries upped their game.

First time seeing this?

🌍 Most Active Malware Families

📈 Infostealers Dominate

Credential theft ruled Q1. Malware like Lumma Stealer, Vidar, Redline, and Raccoon were at the forefront of phishing and malvertising campaigns. Their primary goals? Harvest saved passwords, session cookies, autofill data, and financial credentials at scale.

🎯 Top Infostealers:

Lumma Stealer – Most active info-stealer of the quarter (8 tracked entries). Known for aggressive update cycles and fake CAPTCHA lures.
Vidar, Redline, and Raccoon – Widely distributed via fake installers and cracked software packages.

👁️ Remote Access Trojans (RATs)

Trojans like Njrat, Gh0st RAT, and Dark Crystal were used as initial access tools, providing attackers with persistent control and data exfiltration capabilities. These were often dropped alongside other payloads or bundled with spyware.

💣 Ransomware Keeps Evolving

Ransomware families like BlackLock, Albabat, VanHelsing, and EncryptRAT leaned on phishing and exploit kits to launch rapid, high-impact attacks. Many used new delivery tricks, such as fake Teams calls, email bombing, and subscription lures.

🛠️ Rootkits Resurface

Rootkits like SPAWNCHIMERA, IOCONTROL, and ReaderUpdate highlight a trend toward stealth and persistence. These toolkits embedded themselves deep into systems, evading AV and EDR for long-term access.

🎯 Notable Campaigns of Q1 2025

More than 30 major malicious campaigns were active globally, some showing remarkable technical creativity and targeting diversity.

🔎 Campaign Highlights:

Lazarus Group – Operation 99: Targeted Web3 developers for crypto theft.
Iran’s Sosano Campaign: Spread new spyware via phishing, targeting UAE entities.
Fake CAPTCHA Campaigns: Delivered Lumma Stealer across multiple verticals.
SysBumps Campaign: A rare macOS campaign exploiting Apple Silicon architecture.
FatBoyPanel: Targeted Indian banks using banking-themed phishing kits.
Discord Infostealers: Aimed at gamers and influencers in Discord communities.
Quishing Attacks: Weaponized QR codes for credential theft and malware delivery.

🧠 Technique Trends:

Malware-as-a-Service (MaaS) remains a force multiplier.
Multi-stage loaders and fake update chains are back in style.
Malicious documents (especially LNK and PDF) are used to bypass user suspicion.
“Lookalike” lures abusing CrowdStrike, Micr

🧩 Key Trends to Watch

Fake Updates & Loaders: Adversaries are faking browser, Flash, and even security tool updates to drop malware.
Infostealer Ecosystem Growth: Stealers are resold, customized, and repackaged weekly.
Multi-Payload Campaigns: RAT + Stealer + Rootkit combos are becoming common.
QR Code Abuse: Quishing attacks now appear in emails, flyers, and even WhatsApp messages.
Mac Malware on the Rise: Apple Silicon systems are no longer off-limits.

Get Help

💡 What This Means for Defenders

Credential theft is the gateway to everything. MFA fatigue, stealer logs, and cookie hijacking are driving compromises.
Defense needs to be layered. Endpoint protection alone isn't enough, network monitoring and email hardening are essential.
Social engineering is as effective as ever. From Discord lures to fake HR emails, humans remain the weakest link.
Keep an eye on rootkits. Their return signals a push for stealthy, long-term persistence.

📌 Coming Next Week

Top Vulnerabilities of Q1 2025

We’ll break down the most exploited CVEs, zero-days in the wild, and overlooked weaknesses attackers are loving right now. From unpatched routers to cloud misconfigs, get ready to tighten your defenses where it matters most.

Subscribe and Comment.

Follow CyberMaterial on:

Substack, LinkedIn, Twitter, Reddit, Instagram, Facebook, YouTube, and Medium.