Finance.Yahoo

Rapid7 Q3 2025 Report Details Rise in Ransomware Groups and AI Weaponization

First seen 12 Nov 2025, 19:02 UTC • •36.9

Article Content

1 / 3

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

Rapid7's Q3 2025 Threat Landscape Report, released on November 12, 2025, reveals an increase in active ransomware groups from 65 to 88. The report highlights the growing use of generative AI by attackers and a 21% decrease in newly exploited vulnerabilities, with a focus on older, unpatched CVEs such as CVE-2025-53770 and Cisco ASA/FTD flaws.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 218d ago How this analysis works

More articles in this cluster (2)

Threat Graph

12 entities, 21 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (5)

Malware
Phishing
Ransomware
Supply Chain Attack
T1566 - Phishing

Vulnerability (1)

CVE-2025-53770

Malware (1)

LAMEHUG

Affected Platform (2)

Cisco ASA/FTD
Microsoft SharePoint

Threat Actor (3)

Qilin
Safepay
WorldLeaks

Relationships

Qilin uses LAMEHUG
Safepay uses LAMEHUG
WorldLeaks uses LAMEHUG
Qilin uses Malware
Qilin uses Phishing
Qilin uses Ransomware
Qilin uses Supply Chain Attack
Qilin uses T1566 - Phishing
Safepay uses Malware
Safepay uses Phishing
Safepay uses Ransomware
Safepay uses Supply Chain Attack
Safepay uses T1566 - Phishing
WorldLeaks uses Malware
WorldLeaks uses Phishing
WorldLeaks uses Ransomware
WorldLeaks uses Supply Chain Attack
WorldLeaks uses T1566 - Phishing
LAMEHUG exploits CVE-2025-53770
CVE-2025-53770 targets Cisco ASA/FTD
CVE-2025-53770 targets Microsoft SharePoint

Following this threat?

Track Qilin, LAMEHUG and CVE-2025-53770 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Atlassian Flaw Exploited Within Hours of Disclosure A vulnerability in Atlassian Data Center products, tracked as CVE-2026-21589 with a CVSS score of 9.3, was within two hours of its disclosure. The flaw allows arbitrary file access and affects multiple products, including Bitbucket, Confluence, and Jira. Exploitation activity targeting honeypot networks began…

Ransomware Groups Exploit Palo Alto VPN Vulnerability CVE-2026-0257 Ransomware groups, including Qilin and Settra, are exploiting a high-severity vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS GlobalProtect and Prisma Access products. This authentication bypass flaw allows attackers to create unauthorized VPN sessions, posing significant detection challenges as their…