<\/p>\n
<\/p>\n
While ESET has been covering notorious state-sponsored Advanced Persistent Threats (APTs) targeting high-profile businesses and critical infrastructure for years<\/a>, the new ESET eCrime Reports retrain the focus on expanding the area of financially motivated cybercriminal groups, who are not picky about the size or home region of their targets. Keeping this kind of threat intelligence as practical as possible, the ESET eCrime Reports provide real-world attack scenarios and insight into the TTPs, and add IoCs, hunting rules, and guidance to maximize defense effectiveness.<\/p>\n <\/p>\n <\/p>\n CTA: Try ESET eCrime Reports now!<\/p>\n <\/p>\n <\/p>\n Key points of this article<\/em><\/strong>:<\/em><\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/ul>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n When it comes to the threat landscape, things are going from bad to worse for businesses. Ransomware has effectively become a service for anyone willing to pay, enabling even less\u2011skilled cybercriminals to launch large\u2011scale malicious campaigns. To make matters worse, AI has lowered the barrier to entry even further \u2013 coding is now both easier and faster, and the human capital required to operate these campaigns has significantly decreased.<\/p>\n <\/p>\n <\/p>\n Despite notable progress by law enforcement and the private sector in disrupting active ransomware operations, the ransomware landscape remains very challenging, with new gangs emerging and affiliates moving to other operators. Notably, in 2025, ESET researchers saw increased rivalry, with competitive gangs even attacking each other<\/a>.<\/p>\n <\/p>\n <\/p>\n A similar surge is visible among infostealers<\/a>, which often serve as the initial access vector in campaigns that later escalate into ransomware incidents.<\/p>\n <\/p>\n <\/p>\n Available data confirms the trend:<\/strong><\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/ul>\n <\/p>\n <\/p>\n The increased availability of ransomware certainly doesn\u2019t make it less dangerous. Criminal groups continue to develop new tools like EDR killers<\/a> that exploit vulnerable drivers to disable security solutions. They also rapidly adopt new techniques observed in other threats, such as ClickFix, a social\u2011engineering method that displays a fake error message to trick victims into copy\u2011pasting and executing malicious commands on their devices.<\/p>\n <\/p>\n <\/p>\n CTA: Interested in the latest trends in the ransomware scene? Check out the ESET Threat Report H2 2025<\/a>!<\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n Facing today\u2019s highly dynamic ransomware landscape, businesses can no longer rely on passive cybersecurity tools such as simple endpoint protection products. To deal with evolving threats, businesses need proactive, multilayered defense that includes high\u2011quality threat intelligence.<\/p>\n <\/p>\n <\/p>\n For example, ransomware attacks are often complex, multistage intrusions. Cybercriminals begin with reconnaissance, carefully monitoring the targeted organization. They then deploy malware to compromise the environment and only later encrypt data and demand a ransom. This entire process may unfold slowly over several weeks in order to avoid detection.<\/p>\n <\/p>\n <\/p>\n Naturally, malware operators also monitor the performance of their campaigns and improve their tools and tactics over time.<\/p>\n <\/p>\n <\/p>\n The infostealer ecosystem also largely benefits from the Malware as a Service (MaaS) model, with various affiliates distributing infostealers, which increase the pressure on defenders. On top of that, dedicated marketplaces provide an extremely easy way to monetize stolen credentials.<\/p>\n <\/p>\n <\/p>\n CTA: If you want to see what a real MaaS operation looks like, check this blog<\/a>. <\/p>\n <\/p>\n <\/p>\n <\/p>\n <\/p>\n With its large number of users across different regions, ESET has true global visibility into real\u2011world incidents resolved by its solutions. This foundation enables the creation of curated, factually accurate, and in\u2011depth threat intelligence.<\/p>\n <\/p>\n <\/p>\n One example of such intelligence service in action is our awarded research<\/a><\/a><\/a> about BlackLotus UEFI bootkit, the first publicly known UEFI bootkit bypassing the essential platform security feature \u2013 UEFI Secure Boot. In our research, ESET researcher Martin Smol\u00e1r dismantles this malware into pieces, covering the history of the malware, outlining the bypass process step by step, and offering guidance on how to defend against it.<\/p>\n <\/p>\n <\/p>\n ESET Threat Intelligence<\/a> is backed by world\u2011class researchers and detection engineers who collaborate with leading cybersecurity institutions, including the FBI, the Joint Cyber Defense Collaborative at CISA, the NATO Cooperative Cyber Defence Centre of Excellence (organizer of the Locked Shields exercise), and Europol. <\/p>\n <\/p>\n<\/p>\n
Amassing numbers<\/h1>\n
<\/p>\n
Why threat intelligence is important<\/h1>\n
ESET Threat Intelligence \u2013 global visibility backed by world\u2011class researchers<\/h1>\n
<\/p>\n
![\"\"](\"https:\/\/blog.eset.ee\/wp-content\/uploads\/2026\/03\/image-2.png\")
<\/figure>\n