Ransomware attacks have doubled in the past year: Inetum LiveSOC warns for increasing cyberthreats – Press Release | #ransomware | #cybercrime

Geopolitical reality complicates cybersecurity

In the past 6 months, geopolitical developments and ongoing military conflicts have also impacted cybersecurity. Any statement or sanction issued by an EU member can trigger digital retaliation against servers physically located in our country, making it a recurring target for pro-Russian activist groups. These groups have disrupted parliamentary and municipal organizations and media portals, as well as Febelfin, the Economy ministry, the Belgian Centre for Cybersecurity, NMBS/SNCB and the Port of Antwerp-Bruges. Tensions in the Middle East, India and Pakistan equally have ripple effects across the cybersecurity space globally.

Meanwhile other international malicious cyber actors remain ever present: financially motivated threats like Medusa, RansomHub and Lockbit derivatives, as well as state-sponsored ones like Lazarus, which is linked to the North Korean government. According to the Centre for Cybersecurity Belgium, reports of cyber incidents increased by 80%. An amount that is projected to grow further in the coming years.

Ransomware on the rise

When focusing specifically on ransomware, the number of ransomware attacks compared to the first half of 2024 has doubled in the 19 countries where Inetum LiveSOC is active. In H1 2024, Recorded Future noted down just over 1.000 ransomware cases, while H1 2025 already saw almost 2.500. Belgium is further solidifying its position in the top ten countries who suffer from ransomware attacks most frequently, climbing one position from 9^th to 8^th compared to last year. The top 10 is further completed by the US, the UK, France, Spain, Brazil, India, Mexico, Switzerland and Columbia. 

Other top cybersecurity alerts involve malware, users who add themselves to groups (which triggers possible privilege escalation), the suspicion of a data breach (indicators of compromise), unregistered users who maliciously try to access systems (for instance by brute force attempts) and e-mails who get flagged down for malware of phishing. 

Emilio Jiménez-Gomez, Threat Operations Manager of Inetum’s LiveSOC, further explains: “Next to ransomware and day to day threats, our LiveSOC teams see an increase in Advanced Persistent Threats (APT’s), where cybercriminals gain access to a system for a longer period of time to gather sensitive data, DDoS attacks and the exploitation of vulnerabilities. Many APT’s are linked to Russian and Chinese actors, and are aimed at sensitive sectors like government, healthcare and fintech. The potential impact on Belgian organisations is sizeable: services might get disrupted and sensitive data is potentially compromised.”

Popular methods and trends

The most popular cybercrime methods remain phishing, spearfishing, brute force attacks, the misuse of leaked passwords, and malware. Cybercriminals have also started using more advanced techniques such as AI to scale attacks and avoid detection.

For the coming 6 months, Inetum projects AI to grow into a key tool for threat actors, further automating the identification and exploitation of vulnerabilities, especially for RATs (Remote Access Trojans) and Stealers (information thieves). AI will allow them to become more effective and more easily evade detection. Next to that, DOS attacks are expected to persist in the current geopolitical field. An increase in the exploitation of zero-day vulnerabilities and persistence in ransomware attacks is also expected.

Peter Vandeput, Cybersecurity Lead at Inetum Belgium further warns users, whether personal or enterprise: “We should always remain vigilant for suspicious e-mails and attachments, use strong unique passwords – passkeys are even better – and avoid reusing them on multiple platforms. Next to that, we should frequently scan for vulnerabilities, update software diligently and apply security patches when they arrive. Lastly, we must use multifactor authentication. It’s crucial that companies keep their incident response plans up to date and test them thoroughly, making their leaders and employees aware of cyberthreats through recurring trainings and simulations.”

***

About Inetum