August's Top Threat Actors: Ransomware, Espionage And Infostealers
Barracuda Networks, Monday, September 8th, 2025
Throughout the year we've observed ransomware attacks, data exfiltration and stealthy state-sponsored espionage. These are some of the most significant threats that surged in August 2025.
Qilin is a ransomware-as-a-service (RaaS) operation that we profiled in July. This Eastern European threat actor has become one of the world's most active and damaging ransomware groups. First observed as 'Agenda' in mid-2022, it was fully rebranded as Qilin by September 2022. The group works with affiliates who deploy its ransomware in victim networks; in return, the Qilin administrators maintain the data leak sites and manage the negotiations, payments, and profit-sharing arrangements. According to FalconFeeds threat intelligence, Qilin's 2025 activity peaked in June and claimed 93 victims during the month of August. Comparitech's August research differs slightly, attributing only 86 attacks to the group.