Ransomware and AI to Threaten Global Cybersecurity in 2025
The 2025 cybersecurity threat predictions confirm that ransomware and artificial intelligence will play a significant role in shaping the cyber landscape. Kaspersky Security Bulletin is an annual series of forecasts and analytical reports on key developments in the world of cybersecurity . Last year, most of Kaspersky experts’ predictions regarding the evolution of crimeware and financial cyber threats in 2024 came true .
This includes an increase in AI- powered cyberattacks , fraudulent schemes targeting direct payment systems, open source backdoors, and the evolution of ransomware techniques, among others. In addition, further developments in ransomware techniques are expected in 2025.
Here is a comprehensive analysis of expected ransomware developments in 2025:
Kaspersky experts have confirmed that the ransomware threat is escalating, with its damage going beyond data encryption to deeper and more complex levels. This includes:
1- Data poisoning:
Ransomware in 2025 will not only encrypt data, but will also manipulate it or covertly add incorrect data to databases, a technique called data poisoning.
This will make it difficult to verify the authenticity of the data even after decryption, meaning companies may have to rebuild their entire databases, resulting in significant financial losses.
2- Quantum-resistant encryption:
Advanced ransomware organizations will begin using quantum-resistant encryption as it evolves . Quantum-resistant encryption is designed to resist decryption attempts from both regular and quantum computers, making it nearly impossible to decrypt victims’ data.
This type of encryption will make data recovery more difficult and expensive, as conventional computers will not be able to decrypt it, and quantum computers that can do so are not yet widely available.
This threat will drive the development of stronger and more secure encryption technologies, but at the same time will lead to an arms race between attackers and defenders.
3- Ransomware as a Service:
Ransomware as a service is expected to grow, enabling even the most technically inexperienced threat actors to launch sophisticated attacks using cheap tools costing as little as $40, which will impact the number of attacks and lead to an increase in them.
Stolen information-based attacks are expected to increase in 2025, as popular stealth programs such as Lumma , Vidar , Redline , and others resist law enforcement pressure by adapting and adopting new methods, and new entrants emerge.
Implications of these developments:
- Increased costs: These developments will increase the costs incurred by companies and organizations as a result of ransomware attacks, which go beyond the costs of decryption to include the costs of data recovery, system repair, and the impact of the attack on reputation.
- Complexity of recovery operations: Data recovery operations will become more complex and difficult, especially in the case of data poisoning, requiring significant efforts from specialized experts.
- Increased risk to critical sectors: Critical sectors, such as healthcare, energy, and infrastructure, will be more vulnerable to ransomware attacks, which could have dire consequences for society.
Other advanced and diverse cyber threats:
The future points to major challenges in the field of cybersecurity, as Kaspersky experts confirmed that cyber threats will become more complex and diverse in their methods in 2025, and these developments will require smarter and more flexible defense strategies.
Other important predictions include:
- Attacks on central banks and open banking initiatives: These attacks will target instant payment systems operated by central banks, potentially allowing cybercriminals to access sensitive data.
- Increased supply chain attacks on open source projects: After the XZ backdoor incident , the open source tools community is likely to discover new attack attempts and previously successfully planted backdoors.
- AI in both defense and offense: 2025 will see an acceleration in the use of AI on both the defensive and offensive fronts. While AI will help detect threats and reduce response time, attackers will also use it to develop more sophisticated attacks.
- Emergence of new blockchain-based threats: New blockchain protocols will emerge due to the need for a secure, private, peer-to-peer blockchain network. As a result, new malware, developed with these obscure protocols, will be distributed and used for different purposes.
“Starting in 2025, resilience to financial cyber threats will require strong security measures from both individual users and businesses. The best defense is a combination of threat intelligence, predictive analytics, continuous monitoring and a zero-trust mindset to protect critical data and processes. It is important to organize regular cyber training programs for employees and warn them of potential cyber threats, as unskilled employees are a common initial attack point that can cost organizations significant financial losses,” said Fabio Assolini, Head of Global Research and Analysis Team (GReAT) at Kaspersky Latin America.