The IT Nerd

Flashpoint’s has a new report about the Evolution of Data Extortion that was just released along with a blog post explaining the research.

Flashpoint’s report provides a comprehensive analysis of the evolution of data extortion groups, tracing their trajectory from fragmented, low-sophistication criminal activity in 2015 to a professionalized, cloud-centric, and human-operated threat landscape by 2025. It examines the operational arcs of key threat actors, including “The Dark Overlord,” “LAPSUS$,” and “ShinyHunters,” and documents a fundamental shift in their tactics, techniques, and procedures (TTPs). The focus has moved away from brute-force technical exploits toward sophisticated social engineering and supply chain attacks.
 
The future of data extortion by these and similar groups will likely target software-as-a-service (SaaS) interdependencies and identity federation, requiring a strategic pivot in defensive postures from perimeter-based security toward proactive Cloud Security Posture Management (SSPM) and robust human defenses.
 
Contents of the 18-page report include:

• Opportunistic Data Extortion: 2015–2018
• Group Formalization and Attention Seeking: 2018–2020
• Extortion Platform Consolidation: 2020–2023
• Cloud Extortion and Identity Abuse: 2024–2025
• Role of Specialized Communities

Here’s the link with more details: https://flashpoint.io/blog/data-extortion-ttps-exploiting-code-people/.

This entry was posted on October 28, 2025 at 2:22 pm and is filed under Commentary with tags Flashpoint. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.