Increasing frequency, new threat groups emerging, the rise of ransomware-as-a-service (RaaS) attack model, and third-party attacks are just a few of the dangerous trends Trustwave SpiderLabs details in Energy and Utilities Sector Deep Dive: Ransomware Trends. This report supplements the just released 2025 Trustwave Risk Radar Report: Energy and Utilities Sector. This broader and more comprehensive report analyzes the energy and utilities sector’s major threats and trends.

The energy sector is a cornerstone of national security, ensuring the delivery of critical infrastructure services and supporting transportation systems. Recognizing the importance of protecting this vital industry, Trustwave SpiderLabs has released the comprehensive 2025 Trustwave Risk Radar Report: Energy and Utilities Sector.

As we step into 2025, the high-impact, financially motivated ransomware landscape continues to evolve, shaped by a combination of law enforcement actions, shifting affiliate dynamics, advancements in defensive approaches, and broader economic and geopolitical influences. While 2024 also saw the continued use of ransomware for non-financial gain purposes, such as drawing attention away from other activities – financial motives remained at the forefront of the overall ransomware landscape.

Trustwave SpiderLabs is continuing its multi-year research effort delving into the unique cybersecurity challenges that face different vertical sectors with a new report launching on January 22. This effort analyzes the energy and utilities sector, industries which are increasingly targeted due to their critical role in supporting national and global infrastructures. Ransomware takes center stage in these reports, with Trustwave SpiderLabs reporting an 80% year-over-year surge in such attacks.

The increasing adoption of generative artificial intelligence platforms by threat actors, cyber defenders, and the average organization will present enterprises with an unprecedented number of cybersecurity issues in the coming years, according to a new Gartner report and information from Trustwave subject matter experts.

In the world of malware, common ransomware schemes aim to take the data within databases (considered the "gold" in the vault of any organization) and hold them hostage, promising data recovery upon ransom payment. Typically, most of these schemes follow an expected script: encrypting files, requesting payment, and then delivering a decryption key. This model, while damaging, generally allows victims to recover if they pay the ransom.

The Digital Operational Resilience Act (DORA) is poised to reshape the European financial landscape, demanding a robust defense against cyber threats and operational disruptions and Trustwave is putting the pedal to the metal to prepare clients with our DORA Readiness Accelerator service. The Trustwave DORA Readiness Accelerator, which joins Trustwave’s CMMC readiness and Microsoft Security accelerators, provides a structured approach to achieving compliance and bolstering operational resilience.

In late November and December 2024, Arctic Wolf observed evidence of a mass compromise of Fortinet FortiGate. While the initial attack vector was unknown at the time, evidence of compromise (with new users and SSL profiles) was consistent across compromised devices. On January 14, Fortinet released a formal statement and patch. The vulnerability is an Authentication Bypass via crafted requests to Node.js websocket module and issued CVE-2024-55591. The CVSSv3 score is 9.6.

Organizations today face a rapidly evolving threat landscape, and as they plan their cybersecurity strategy and budgets, many may struggle with a key question: If I’m conducting regular vulnerability scans, and patching the vulnerabilities I identify, do I really need penetration tests as well? The answer is yes. While vulnerability scanning plays a vital role in identifying risks and vulnerabilities, relying solely on it for security creates blind spots.

Trustwave SpiderLabs first blogged about Magecart back in 2019; fast forward five years and it is still here going strong. During the pre-holiday season, cybercriminals ramped up their efforts to target e-commerce websites, aiming to steal cardholder and personal information. These attacks, collectively known as Magecart, have been active since 2015, named after the Magento e-commerce platform with "cart" referencing shopping carts — their initial primary targets.