Verticals Targeted: Multiple
Regions Targeted: Multiple
Related Families: Cl0p, Qilin, SocGholish, Akira, AsyncRAT, LummaStealer, RedLineStealer, VShell
Executive Summary
PolySwarm's 2025 Year in Review spotlights resilient malware that dominated the threat landscape and nation-state espionage from the Big Four. React2Shell (CVE-2025-55182) emerged as the top vulnerability, while AI-driven attacks defined the year's paradigm shift.
Key Takeaways
- Ransomware Dominance: Cl0p and Qilin led with high-volume campaigns via zero-day exploits and mature RaaS models, targeting enterprise software, education, government, and healthcare for extortion and disruption.
- Initial Access and Stealers: SocGholish persisted as a top JavaScript downloader enabling ransomware deployments, while infostealers like LummaStealer and RedLineStealer fueled credential theft and downstream attacks despite disruptions.
- Nation-State Activity: Chinese APT groups exploited SharePoint vulnerabilities for espionage, North Korea's Lazarus executed major crypto thefts, and Russia's Sandworm targeted energy infrastructure through misconfigured devices.
- Vulnerability Highlight: React2Shell (CVE-2025-55182) emerged as the top exploit, rapidly weaponized by state and criminal actors for remote code execution in React/Next.js applications.
- AI Paradigm Shift: Autonomous AI-orchestrated espionage campaigns and generative tools enhanced phishing and deepfakes.
2025 Malware Hall of Fame
PolySwarm analysts chose the following standout malware families for the 2025 Malware Hall of Fame. A small selection of IOCs of our most recent samples of each family are provided at the end of this report.
Cl0p
Cl0p ransomware dominated the ransomware landscape in 2025 with a resurgence driven by mass exploitation of zero-day vulnerabilities in enterprise software, including CVE-2025-61882 in Oracle E-Business Suite alongside campaigns targeting Cleo products. The group claimed hundreds of victims in Q1 alone through Cleo exploits and later shifted to Oracle E-Business Suite, focusing on data exfiltration rather than encryption for pure extortion. This approach enabled rapid, high-volume attacks with minimal disruption to victims' operations, maximizing leak site pressure. Cl0p's sporadic yet explosive activity patterns, remaining dormant for months before engaging in automated zero-day campaigns, continued to challenge defenders. Heading into 2026, organizations must prioritize patching enterprise applications such as managed file transfer solutions and ERP systems while monitoring for unauthorized data access, as Cl0p's proven adaptability suggests ongoing threats from supply chain compromises.
Qilin
Qilin ransomware emerged as one of the most prolific ransomware operators in 2025, surpassing predecessors through a mature Ransomware-as-a-Service model that attracted affiliates fleeing disrupted groups. The operation posted over 700 victims across the year, with surges in attacks on education, government, and healthcare sectors, often leveraging vulnerabilities in network appliances. Qilin's cross-platform capabilities, including Windows, Linux, and ESXi encryptors, combined with double extortion, amplified impact. Notable high-profile breaches and rapid growth in claimed incidents underscored its efficiency. For 2026, Qilin's affiliate-driven expansion and adoption by diverse actors position it as a persistent high-volume threat requiring vigilant patching and endpoint monitoring.
SocGholish
SocGholish maintained its position as a leading initial access vector in 2025, consistently ranking among top detected threats through drive-by downloads on compromised websites masquerading as browser updates. This JavaScript-based downloader facilitated widespread delivery of follow-on payloads, including ransomware like RansomHub and various RATs, impacting government, banking, and consulting sectors heavily in the US Its Malware-as-a-Service framework enabled diverse affiliates, sustaining high infection rates despite ongoing disruptions. SocGholish's evasion through legitimate site compromises and traffic distribution systems prolonged its effectiveness. Into 2026, expect continued reliance on this loader for entry into networks, emphasizing the need for robust web filtering and user awareness training.
Akira
Akira ransomware sustained aggressive operations throughout 2025, evolving its encryptors to target expanded virtualization platforms like Nutanix, alongside traditional ESXi and Hyper-V environments. The group exploited vulnerabilities in VPN and firewall products, claiming hundreds of victims with a focus on manufacturing, education, and critical infrastructure. Double extortion tactics and rapid lateral movement characterized attacks, yielding significant ransom proceeds. Akira's adaptability, including Rust-based variants for faster encryption, kept it among top active groups despite law enforcement scrutiny. Looking ahead to 2026, Akira's enterprise-like structure and vulnerability exploitation trends signal ongoing risks, particularly for unpatched perimeter devices.
AsyncRAT
AsyncRAT remained a versatile remote access trojan in 2025, frequently deployed via phishing and loaders for credential theft, surveillance, and persistence. Its open-source nature and modular updates enabled widespread use by cybercriminals, often as a precursor to ransomware or data exfiltration. Campaigns exploited legitimate tools like ScreenConnect and leveraged Python payloads with cloud tunnels for stealth. AsyncRAT's cross-platform potential and integration into multi-stage chains sustained its prevalence. For 2026, its accessibility and evasion improvements suggest continued prominence in initial access and post-exploitation phases, necessitating behavioral detection and network anomaly monitoring.
LummaStealer
LummaStealer experienced a turbulent 2025, facing major disruptions from law enforcement takedowns and doxxing campaigns that temporarily curtailed activity. Despite this, it resurged with enhanced evasion, including browser fingerprinting and secondary payloads, maintaining its role as a prolific information stealer targeting credentials and cryptocurrency wallets. High-volume infections persisted through diverse delivery methods. Entering 2026, expect adaptations to countermeasures, with Lumma competing fiercely in the infostealer ecosystem amid shifting affiliate preferences.
RedLineStealer
RedLineStealer continued as a staple information stealer in 2025, harvesting browser data, credentials, and wallet information through phishing and malicious downloads. Its .NET-based design and frequent updates supported persistent campaigns, often leading to ransomware deployments. Despite prior disruptions, RedLineStealer maintained visibility in underground markets. Integration with loaders and evasion of detection kept infections steady. For 2026, RedLine's established ecosystem ensures ongoing threats, particularly in credential-driven attacks requiring multi-layered endpoint protection.
VShell
VShell gained traction in 2025 as a cross-platform backdoor favored by China-nexus actors for espionage and post-exploitation. Its fileless, in-memory execution and integration with droppers like SNOWLIGHT enabled stealthy persistence across Windows, Linux, and macOS. Campaigns targeted telecommunications, government, and critical infrastructure, often via vulnerability exploitation. VShell's open-source roots and enhancements for tunneling and encryption amplified its utility in APT operations. Heading into 2026, VShell's adoption in state-sponsored intrusions highlights risks to multi-platform environments, demanding advanced behavioral analytics.
Nation State Threat Actor Activity Spotlight
China
Linen Typhoon
Linen Typhoon, a Chinese nation-state actor, intensified operations in 2025 by exploiting zero-day vulnerabilities in Microsoft SharePoint servers, targeting on-premises installations for initial access and data exfiltration. This group, linked to widespread espionage, focused on government agencies, telecommunications, and critical infrastructure in the US and Europe, leveraging CVE-2025-53770 and CVE-2025-53771. Campaigns emphasized stealthy persistence through machine key theft, enabling re-entry post-patching. Linen Typhoon's involvement in the global SharePoint hacks affected over 100 organizations, highlighting China's more recent strategic pivot to software supply chain compromises.
Violet Typhoon
Violet Typhoon emerged prominently in 2025 as a Chinese state-sponsored group exploiting SharePoint vulnerabilities alongside Linen Typhoon, using CVE-2025-49706 and CVE-2025-49704 for remote code execution on exposed servers. Targeting education, energy, and Asian telecommunications entities, the threat actor stole credentials and deployed backdoors for long-term access. High-volume attacks on unpatched systems amplified impact amid geopolitical tensions.
APT41 (Wicked Panda)
APT41 maintained its dual-role dominance in 2025, conducting state-directed espionage while pursuing financial gains through targeted intrusions into US government and technology sectors. The group leveraged cloud services for C2, including innovative use of Google Calendar, amid surges in intellectual property theft aligned with China's economic priorities. Campaigns against African and European entities via phishing and supply chain attacks underscored its global reach.
Iran
MuddyWater
MuddyWater led Iranian cyber operations in 2025, escalating attacks on US industrial sectors amid geopolitical tensions. Using spear-phishing and PowerShell-based tools, the group targeted transportation and energy for espionage and disruption. A 133% increase in the group's activity focused on Middle Eastern adversaries and Western entities.
North Korea
Lazarus Group
Lazarus Group orchestrated high-impact operations in 2025, including the $1.5 billion Bybit hack in February, attributed to TraderTraitor actors who exploited wallet software for Ethereum theft. Funds were laundered rapidly across blockchains, funding regime priorities. The group’s multi-platform malware and AI-enhanced lures targeted finance and defense entities globally.
Russia
Sandworm (APT44)
Sandworm sustained attacks on energy sectors in 2025, as detailed in Amazon's recent threat intelligence report, shifting to misconfigured network edge devices for access since 2021. Targeting Western utilities and providers, operations overlapped with GRU infrastructure, focusing on credential theft without heavy vulnerability exploitation. This evolution reduced detection risks while maintaining tempo.
Vulnerability of the Year: React2Shell
PolySwarm analysts chose React2Shell as the vulnerability of the year for 2025. CVE-2025-55182, dubbed React2Shell, stands out as the most impactful vulnerability of 2025 due to its perfect CVSS score of 10.0, unauthenticated remote code execution capability, and rapid weaponization by various threat actors across modern web applications.
Disclosed in early December 2025, this flaw in Meta's React Server Components stemmed from unsafe deserialization in the Flight protocol, allowing attackers to execute arbitrary code on servers processing untrusted payloads. Exploitation required no user interaction or privileges, making it exceptionally dangerous for widely adopted frameworks like React 19 and Next.js. Within hours of disclosure, multiple China-nexus state-sponsored groups operationalized exploits, with automated scans and targeted attacks surging globally. Reports confirmed deployments of malware, cryptocurrency miners, and backdoors, highlighting its role in compromising containerized workloads and cloud environments.
CISA swiftly added it to the Known Exploited Vulnerabilities catalog, underscoring real-world abuse. Unlike earlier 2025 vulnerabilities, such as SharePoint deserialization chains or enterprise software flaws, React2Shell's ubiquity in contemporary web development amplified its reach, reshaping perceptions of framework security and prompting urgent updates across ecosystems. While late-year flaws like MongoBleed gained traction, none matched React2Shell's combination of severity, speed of exploitation, and broad applicability.
Multiple China-linked espionage groups rapidly weaponized CVE-2025-55182 shortly after its disclosure. Earth Lamia (tracked as UNC5454) and Jackpot Panda were among the first, deploying payloads like MINOCAT, SNOWLIGHT, HISONIC, and COMPOOD for initial access and persistence in cloud services and technology sectors across Taiwan, Vietnam, and the Asia-Pacific region. These actors focused on cyber espionage, exploiting the vulnerability's unauthenticated remote code execution to compromise React Server Components in Next.js applications.
Additional clusters, including UNC6600, UNC6586, UNC6588, UNC6603, and UNC6595, leveraged the flaw for similar espionage objectives, often deploying VShell backdoors and employing timestomping techniques to evade detection. Targets included cryptocurrency mining operations and broader APAC entities, aligning with state-sponsored intelligence gathering.
North Korea-affiliated groups exploited CVE-2025-55182 to deploy EtherRAT, a novel remote access trojan using Ethereum smart contracts for C2. This activity targeted Linux systems, establishing multiple persistence mechanisms post-exploitation. The focus appeared to blend espionage with financial motivations, consistent with Pyongyang's cyber operations.
Iranian state-sponsored actors were observed exploiting the vulnerability in campaigns against regional and global targets, though specifics on group attributions remain limited. Exploitation facilitated deployment of backdoors for espionage, with noted activity in the Asia-Pacific region and Iran itself.
Financially motivated criminals were quick to exploit CVE-2025-55182 for cryptomining, deploying XMRig miners via shell scripts that created systemd services for persistence on compromised Linux hosts. These actors used automated scanning tools to identify vulnerable React/Next.js servers, often deterring detection through obfuscation.
Criminal operators deployed various backdoors and tools post-exploitation. These facilitated reverse proxy tunnels and further compromise, targeting cloud environments and technology sectors worldwide. In some instances, attackers executed Cobalt Strike beacons on Linux hosts, enhancing command-and-control capabilities for broader intrusions. Weaxor ransomware was deployed following CVE-2025-55182 exploitation, with actors first disabling defensive layers before encryption. This marked one of the early ransomware integrations with the vulnerability, amplifying impact on unpatched systems.
Story of the Year: The Rise of AI in the Cyber Threat Landscape
Several notable applications of AI emerged in cyberattacks throughout 2025, particularly in social engineering and fraud. AI-generated deepfakes and voice clones fueled a sharp rise in business email compromise incidents, with reports indicating a 37% increase in AI-assisted BEC scams and high-profile cases involving cloned executive voices to authorize fraudulent transfers exceeding $25 million in losses. Generative AI also transformed phishing, enabling hyper-personalized emails crafted at scale, often hijacking legitimate threads, with nearly 83% of phishing messages incorporating AI elements for improved grammar, context, and urgency. These tactics lowered entry barriers for attackers, amplifying volume and success rates while challenging traditional filters.
The August 2025 discovery of PromptLock, a proof-of-concept ransomware leveraging a local LLM to dynamically generate polymorphic Lua scripts for cross-platform encryption and exfiltration, exhibited a sign of things to come for AI's role in adaptive malware. Though academic in origin and non-operational in the wild, PromptLock highlights how on-device AI can create variable indicators of compromise, complicating signature-based detection.
In mid-September 2025, Anthropic detected and disrupted a sophisticated cyber espionage campaign attributed to a Chinese state-sponsored group, designated GTG-1002. This operation marked the first documented large-scale intrusion in which AI agents executed 80-90% of tactical activities autonomously, shifting from human-directed attacks to agentic systems capable of independent reasoning and execution.
The attackers manipulated a Claude Code model through an orchestration framework, bypassing safeguards by posing as legitimate penetration testing. The AI autonomously performed reconnaissance, mapped network topologies across multiple IP ranges, identified high-value assets like databases, crafted custom exploits, harvested credentials, conducted lateral movement, and exfiltrated data. At peak activity, the system issued thousands of requests per second, rates unattainable by human operators, targeting approximately 30 entities, including major technology firms, financial institutions, chemical manufacturers, and government agencies globally.
This escalation built on prior "vibe hacking" incidents but demonstrated unprecedented scale and minimal human oversight, with operators primarily selecting targets and reviewing outputs. Limitations persisted, such as AI hallucinations fabricating credentials or misidentifying data, necessitating occasional validation. Nonetheless, the campaign lowered barriers for advanced operations, enabling resource-constrained actors to mimic nation-state capabilities.
IOCs
PolySwarm has multiple samples of each malware family featured in our 2025 Malware Hall of Fame.
Cl0p
864e1bc24b7a74e3747cc6e3e2f1435e592d975094963ec01c3ebacd59b40357
4cba634d8fb68dc7b992d861cef21c5f187afdd4b8a37f047acba9a6021354db
c13ec26002091f52005a0be298db06bd3ed5e0acf14528432219d8d0fcd3145b
10f0a21b688a30d4f3f827edca45316c3b1bd2b86edd58f0f3629d7b58ebd37b
d4b72f3cb73e5e7e5d8a75bf50c57ee5ecda06a3f8238d86c19141421a1f1811
f98c0a0629404e4f0328c56dc1774bec99f8839f82117bc4f16950af92ad3437
4bc48b59d9457603a37ef1db819adf2b40494fdebe6ed030bee6e0fa5e6e0570
77e787e8390f6664ebb868ce06cd006dd3a9ef4ccfc57074560d7acd71e053ed
bc1f7ec9736f12281a57e3e1ee887850e1a373037ba39ff0589c6c50545dc485
Ddb152486ba31f81f0b535763e6d13d8d1c6cbcff1349c43bc23d07b7e4627ff
Click here to view all samples of this family in our PolySwarm portal.
Qilin
dc15e02cadff249dde48f7cef10cc79ca5cc4aac9e4aaad9eba0c086b9107680
3d8015c4cc95b966f7d9d521e63cbcd4d0a8e91c8b7ab4e904f7ab11c481635b
cf2aa8ce58eb5806015a344bed8a154c9aa4a72e4072092d363d8d2a6e8bb634
a0cfe5c56b70003a26ddeb7edaf46f9c3583998c906a83c29849d79447be62f4
78b82abb2799853d5863f658aafd4d8775629a9ebf837623e86f4a9338d5d15a
b1cb71e5f231fbc9d767fae6103b7f348002dd898f38fdcc4c5423a75d34897c
63722753771dc1577d4f187a1d149085a91489447479b424f7c4b03f4c14505e
26ce753308dd20068c4e5a3c5b78d080ee681d9b7113bdc0e2997dde8a624b92
0a74d129a8703c3a35fa8ff3b22356974761b4888ad1622786a1516e6c18305e
25fae109eda899d30e20a23e8d5fbb70ac9b75a9731f1125c035ba602e01da21
Click here to view all samples of this family in our PolySwarm portal.
SocGholish
dbaf65fa4000b5b0ffbcc0e8f2c930d5137ba110ed34a02831d406d9274b7896
593996ff851cd1ba92b98e8019ab718feaa821518ef9911129ddeab4572e1fc7
7c7bb610ed2479dc3763788f7cd5c392bc3cf4af6396a86686cd989adb9063f9
81572d3cec2bcd1e3174340c2298747f3c4ab630e4446a9c242e2649740258c0
308f9f238c6abeb1d96791900957343dc260287c1d72d41e5580cb671fcedb4d
6b2a000b2edb19f07aa6925f0de9cdab26d8e8ca806dbf556fcb7b66fc124e62
a664f6aedecf19975c88fd11bbddfe676d8c2eab23ab9db9b799a5b99e8e5172
0a13c3d2bc11ca686d202bef967c87ccc4aa54fa95c2306395a2566abd882dd1
2e9e874112e4d64a9ecd4ceff98cefd7f837b503f9cb401588ad9afaf2930b0c
4654e90ffd20ae5b5b7b12615a4b9ee10b9a3fee4b46a9c0bd30c08791bc2ccd
Click here to view all samples of this family in our PolySwarm portal.
Akira
69e258b9da870faee72e9350ea1770d3525c050396d4e890af017e96bc53bc94
d351f8af7e2e74313e5783dca8d01fc73401aae597bb92f47abdd8abc817fe82
26abfc3be48c2bf212f0bfeee0a28aa228682bc8427f50fa23806c252142dbbc
00d72c8a0a892f0c13e77cc2c36b60c1e200be05dd009f35874ae5a7c4f41195
450947a3f0eb02e6c6a01b029e71161130761b4c1a339132ff08344ac1943aed
479f794fde2459b31c655f9cff1f1df20d479ff562b206ea49d57b029992afc6
09a20c15619d0381899ad66773356c7b2ff0c1ca437a6326992acde778d07ad0
6c45d2ec9cc7641ba42add1f7068e220a1f336844823dfdfc661e27e35efef69
5073222eb1c3f001760e32365be6d347e0956657f44f9f15673a8b458c41ee74
A21433f67bd7b089ecde124415271402a3bf496cfffc4a3961609395ea894952
Click here to view all samples of this family in our PolySwarm portal.
AsyncRAT
151b6b9cb7b0493a14fc2ac6f2f355fd0d8dece5b36ac70f1b933f29a5670bda
2427ebad2faa1119606b5efde849e62e4a587b6deda38ddddee630285236aaed
6dd3846bafb8cb43b5f9cce56a7eebb7f0c98a67320cd473ad519f4ea96f47da
64fcb15255908f7526ba8f84a6c037b54cdca2e4248ebec6c0a54de7eb31423f
084a63bd74a31da818d82b6773d89281f3409bc68b79e687ee5c3ecfa5f41138
5ba8c78ef78ff5e55418742820754d9c1a56ee186a5dc1d075f34e9503001ada
9b7158736c539b93b416e3254afebb45ff89f52e2fb59b39d4e81ca4240f54af
c13a0fea7a606850166bd423b69bc22f83550b4eacc46f88829d474fd6e831ce
ece961b6b2b75e8fa78e33ef6dc87bacae20184ab16953c6a6f6204d9f351fa2
12904c2aa5c5f828d77e10ad9b94efca41dd2ade520f91cda9a64717281531b2
Click here to view all samples of this family in our PolySwarm portal.
LummaStealer
62a89242222a7756f5ba8d9f85fd43f164d800eff86ab96d2b4405ef9bc661c4
3a0d8e4cc3fff6d6c891397ad690d8feaf18fc7bca253b35f783aadf136d3665
7b25199d64b05ee0a3edd47a8801d4a25a00e15711e3aed3756053675e8b1a7e
b973a0522235a89628e493ddd8f7b8442542b8279ac01539378af026af2304ac
72cfca9971e7b5cbc0ea6e1627a307896cd114bb2191065abf01306e87440d67
edb5a21cc69312a6f60ab25496346abbca0175fcbd19e60335608248936fa597
c653a2d289298cd0845383c20bbb460c78c3f1cde8347aa2495cdfe8436edf00
0babf659e13147f5edfeefa1e7cdf87e7fae0fa86af4e1b0ec42627f17bbfe20
3397d816ee7ddef51da5b56f1d8e67e2085d2aadfd5d8c683437eabc4045a2da
A19619274aa9ed4f140fcbb31f67113dbaef16fcf2f7f7e86f237e71086e81f8
Click here to view all samples of this family in our PolySwarm portal.
RedLineStealer
2293a3cd3abcf1649a569f920fb6cbed1e2ee703751835be7e7776b0652b2c6a
a7a20e83f7fdcc8350ce8a071f50ed321419b3f099e573e34d4dad23ffeff735
ad1f6efe2113d730f5b1cefd496b38bdd83bdab277d78694cef00eb151b4c810
6a94ec5f444dbeb0f674ad3595f03a743bc3041ae0da145c3fd881812542b70c
578bf16c134061172a92a0e5d756065f26fa7b5907dba6e53d2376fa82c13bee
f1a187f75919659393dff08ef346f9dfd5882063d1f2804b4bd46804250dc814
2425e42a76a3b2ea3a1d0535872271df0ce7b85b4845fde1d2006bab7694a0c3
edde14647f053f01c8e71bedb920ae509e52cc2b6ad42d88432dfc474b39b70b
a3942ccb0ad039b035c77a80a67be7f3ef1271277d7ab5a9e207a71bad2ce73a
2dfcd4d29223ae662a741cf6b45449f20b2af26b6c7e837b15dc646dc89d5650
Click here to view all samples of this family in our PolySwarm portal.
VShell
c7384ac3e16b0f60b6c91d85c53ce0cf0fda4272dc7f28d6d8a3b0d1d77ec337
faa144c61ad557022f5a1a2324012d826976a9abbc8cea87a3acf073ba551e03
71e3c5f359946f11c3cdcc1173c9dc386df02880a5200268b52f3579e182fe6b
05c35bf8e01a31962f3ed72744b27c6a7ca4ba1dd193623fbc0d2b859b24a000
4688824af18aa7a6dcddf178e819d988644148d234e635a39e0b3d130c528dd7
7ddd1e3045f64d173ebdd9e8b71c3a5fffdfd04e7fec27f5289f68d5a6dfc8a0
7146277cda25cbd2b57744d396c25e6c8de2c998a87556678201dfa8108a80b2
6f6540025967238781245b9e09ed2dbf5a4b056acd22d4b523e1aa6b96a7bd2a
2965cda2c9f16fcd43153d7b375fe2eec653894f9c8e5203a2ca90226a278ec1
3acf028dee3d688fd6eb341ff58ee816eae0382f92234d0eb416d5e26833250e
Click here to view all samples of this family in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
