The State of Ransomware in 2025: The Growing Risk in Cloud Environments 

Ransomware continues to be one of the most resilient and adaptable cyber threats. In 2024, ransomware attacks increased by 3% compared to 2023, reinforcing the persistent danger that these threats pose to organizations worldwide.  

Although traditional ransomware tactics persist, threat actors are now increasingly focusing on cloud environments. As businesses increasingly rely on cloud-based infrastructure, the attack surface for cybercriminals expands significantly. 

The Evolution of Ransomware Techniques 

Morphisec Threat Labs has observed a rise in highly sophisticated tactics used to deliver ransomware and other malware. Ransomware gangs are refining their methods to maximize impact and evade detection. Some notable trends include: 

• Multi-Stage Malware Deployment: The sophisticated ValleyRAT malware, linked to the Silver Fox APT group, exemplifies how attackers continuously refine their TTPs (tactics, techniques, and procedures). The group reuses infrastructure and employs diverse distribution channels—including phishing emails, malicious websites, and instant messaging—to spread Remote Access Trojans (RATs). 
• Targeting High-Value Positions: Attackers are focusing on finance, accounting, and sales professionals due to their access to sensitive data and critical systems. 
• Weaponizing CAPTCHA Systems: Attackers now use Telegram-based fake CAPTCHA verification to deceive cryptocurrency community members, luring them into executing malicious scripts. 
• Sophisticated Fake Update Campaigns: CoinLurker, a stealer written in Go, employs Microsoft Edge Webview2 to execute malware via a fake browser update GUI, triggering a payload execution upon user interaction. 

These advanced tactics illustrate how cybercriminals are adapting to security measures and the detection-based technologies most companies use, making ransomware attacks more evasive and destructive. 

The Shift to Cloud Ransomware Attacks 

As organizations increasingly migrate to cloud-based services, attackers have evolved their ransomware campaigns to target these environments. Cloud environments introduce new vulnerabilities that attackers are eager to exploit, including misconfigurations, weak identity management, and insufficient monitoring. 

Several high-profile ransomware attacks targeted cloud environments in 2024 and showcase the growing threat: 

1. Cloud Storage Encryption Attacks – Attackers compromised misconfigured Amazon S3 buckets and Google Cloud Storage instances, encrypting vast amounts of critical business data and demanding ransoms for decryption keys. 
2. Cloud Identity Hijacking – A major cloud service provider suffered unauthorized access to customer instances, resulting in data stolen from the provider’s tenant.  
3. SaaS-Based Ransomware Attacks – Ransomware groups leveraged OAuth token abuse to gain persistent access to SaaS applications, exfiltrating data before encrypting it and demanding ransom payments. 

Why These Attacks Are Successful 

Cloud environments introduce unique challenges that make ransomware attacks highly effective. Those include: 

Misconfigurations—Many cloud breaches stem from human error, such as improperly secured storage buckets, excessive permissions, and unmonitored access controls. 

Shared Responsibility Model Gaps—Organizations assume cloud providers secure everything, but responsibility for identity and access management, logging, and endpoint protection often falls on the user. 

Complex Identity Management—Cloud environments rely on intricate identity and access controls that, if poorly configured, provide attackers with privileged access paths. 

Lack of Cloud-Specific Security Measures—Many organizations fail to implement cloud-native security tools, such as workload protection platforms and behavioral analytics, leaving gaps for ransomware actors to exploit. 

Why Cloud Ransomware Attacks Will Continue to Rise 

The trajectory of ransomware suggests that attacks against cloud environments will only become more prevalent in 2025 and beyond. With vast attack surfaces and increasing reliance on distributed systems, attackers are actively targeting businesses with encryption-based extortion schemes.  

Cloud-native attacks, identity compromises, and TTPs that specifically target cloud layers give attackers new entry points to exploit. Additionally, traditional detection-based security solutions that rely on signatures may miss evolving attacks that use undetectable and evasive techniques. To stay protected, organizations must adopt proactive anti-ransomware strategies that stop cloud attacks before they can cause damage.  

Building Adaptive Resilience to Weather the Storm 

Whether you’re an IT leader, security professional, or cloud architect, practical strategies and innovative technology are critical to protecting cloud environments and proactively stopping attacks before impact.  

Morphisec and Stream Security, a leading cloud detection and response (CDR) provider, are teaming up to provide security practitioners with tips and actionable tactics to defend against ransomware attacks in cloud environments. 

Secure your spot to learn how to: 

• Stop ransomware at the earliest stages, eliminating the need for costly incident response.  
• Leverage automated, hands-off solutions to strengthen security defenses without adding complexity.  
• Automate response actions that isolate affected resources, limiting ransomware’s ability to spread.  
• Gain real-time visibility into cloud configurations, identities, and activity to detect and disrupt ransomware attacks before they escalate.  

Ransomware is not going away, but with the right defenses in place, businesses can minimize risk and mitigate the damage caused by these relentless attacks. Register today and learn how you can outsmart ransomware with Stream Security and Anti-Ransomware Assurance from Morphisec. 

About the author

Brad LaPorte

Chief Marketing Officer

Brad LaPorte is a seasoned cybersecurity expert and former military officer specializing in cybersecurity and military intelligence for the United States military and allied forces. With a distinguished career at Gartner as a top-rated research analyst, Brad was instrumental in establishing key industry categories such as Attack Surface Management (ASM), Extended Detection & Response (XDR), Digital Risk Protection (DRP), and the foundational elements of Continuous Threat Exposure Management (CTEM). His forward-thinking approach led to the inception of Secureworks’ MDR service and the EDR product Red Cloak—industry firsts. At IBM, he spearheaded the creation of the Endpoint Security Portfolio, as well as MDR, Vulnerability Management, Threat Intelligence, and Managed SIEM offerings, further solidifying his reputation as a visionary in cybersecurity solutions years ahead of its time.