Palo Alto Networks’ Unit 42 Extortion and Ransomware Trends Report Reveals Aggressive New Tactics and the Escalation of Threat Actor Collaboration

Palo Alto Networks® (NASDAQ: PANW), the world’s leading AI cybersecurity company, recently released the Unit 42 Extortion and Ransomware Trends January-March 2025 report, which revealed that threat actors are evolving their tactics, collaborating with state-backed groups and using extortion scams to extract payments.

Organizations across the Asia-Pacific and Japan region are putting their security posture first, and many are now detecting intrusions early in the attack lifecycle, before attackers can execute their objectives. This has led to an increase in incident response cases that are contained at the network access stage. Despite progress, ransomware and extortion campaigns continue to succeed at significant rates. Analyzing Palo Alto Networks’ Unit 42 incident response cases, Unit 42 researchers found that in response, threat actors are intensifying their tactics, using more aggressive methods to pressure victims and secure higher, more consistent payouts. Organizations therefore must stay aware of trends in ransomware and employ a defence-in-depth strategy for protection to remain prepared for ransomware attacks.

“We’re seeing a clear shift in how ransomware and extortion actors operate globally and across the Asia-Pacific and Japan region. Attackers are shifting from traditional encryption tactics to more aggressive and manipulative methods including false claims, insider access, and tools that disable security controls,” said Philippa Cogswell, Vice President and Managing Partner, Unit 42, Asia-Pacific & Japan, Palo Alto Networks. “These new and evolving tactics show just how critical it is for organizations to move beyond reactive defences and invest in security strategies that provide full visibility and rapid response across their environments.”

In the Philippines, ransomware continues to pose a serious threat to both public and private organizations. These attacks have caused major disruptions to online services and encrypted sensitive data across critical systems, often halting operations until ransoms are paid or systems are restored.

With millions of cyber threats detected daily in the country, the risk of ransomware demands urgent and coordinated action. In fact, the Philippines’ National Cybersecurity Plan 2023–2028 prioritizes the protection of critical information infrastructures and adopts a proactive defence posture, specifically including ransomware readiness and incident response capabilities. However, to stay ahead of increasingly sophisticated attacks, organizations will also have to invest in proactive threat detection, adopt AI-powered security tools, and strengthen collaboration across sectors.

Key findings of the report include:

• Attackers are lying to get paid: Unit 42 observed a growing number of cases of extortion scams using fake data and even physical ransom notes sent to executives’ homes.
• Manufacturing remains the top ransomware target, continuing a trend that has persisted for several years. The second most impacted industry is wholesale & retail, followed by professional & legal services.
• Ransomware activity by location headquarters: The most targeted regions for attackers are the United States, Canada, UK, Germany.
• Cloud and endpoint security are under siege: Attackers are increasingly using “EDR killers” to disable endpoint security sensors and targeting cloud systems more aggressively than ever before.
• AI-generated insider threat extortion on the rise: North Korean operatives using AI-generated identities to post as remote IT workers have extorted companies by stealing proprietary code and threatening public leaks.
• RansomHub emerges as top ransomware variant: RansomHub became the most prolific ransomware observed during the reporting period. This marks a sharp rise from mid-2024, when it was first identified as an emerging threat to watch.