{"id":53122,"date":"2023-08-08T02:00:00","date_gmt":"2023-08-08T02:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits"},"modified":"2023-08-08T02:00:00","modified_gmt":"2023-08-08T02:00:00","slug":"ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/","title":{"rendered":"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg\" class=\"ff-og-image-inserted\"><\/div>\n<p>The number of organizations that became victims of ransomware attacks surged 143% between the first quarter of 2022 and first quarter of this year, as attackers increasingly leveraged zero-day vulnerabilities and one-day flaws to break into target networks.<\/p>\n<p>In many of these attacks, threat actors did not so much as bother to encrypt data belonging to victim organizations. Instead, they focused solely on stealing their sensitive data and extort victims by threatening to sell or leak the data to others. The tactic left even those with otherwise robust backup and restoration processes backed into a corner.<\/p>\n<h2 class=\"regular-text\">A Surge in Victims<\/h2>\n<p>Researchers at Akamai <a href=\"https:\/\/www.akamai.com\/newsroom\/press-release\/akamai-research-rampant-abuse-of-zero-day-and-one-day-vulnerabilities-leads-to-143-increase-in-victims-of-ransomware\" target=\"_blank\" rel=\"noopener\">discovered the trends<\/a> when they recently analyzed data gathered from leak sites belonging to 90 ransomware groups. Leaks sites are locations where ransomware groups typically release details about their attacks, victims, and any data that they might have encrypted or exfiltrated.<\/p>\n<p>Akamai&#8217;s analysis showed that several popular notions about ransomware attacks are no longer fully true. One of the most significant, according to the company, is a shift from phishing as an initial access vector to vulnerability exploitation. Akamai found that several major ransomware operators are focused on acquiring zero-day vulnerabilities \u2014 either through in-house research or by procuring it from gray-market sources \u2014 to use in their attacks.<\/p>\n<p>One notable example is the Cl0P ransomware group, which abused a zero-day SQL-injection vulnerability in Fortra&#8217;s GoAnywhere software (<a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/clop-keeps-racking-up-ransomware-victims-with-goanywhere-flaw-\" target=\"_blank\" rel=\"noopener\">CVE-2023-0669<\/a>) earlier this year to break into numerous high-profile companies. In May, the same threat actor abused another zero-day bug it discovered \u2014 this time in Progress Software&#8217;s MOVEIt file transfer application (<a href=\"https:\/\/www.darkreading.com\/attacks-breaches\/cl0p-gang-exploit-moveit-flaw-2-years\" target=\"_blank\" rel=\"noopener\">CVE-2023-34362<\/a>) \u2014 to infiltrate dozens of major organizations globally. Akamai found Cl0p&#8217;s victim count surged ninefold between the first quarter of 2022 and first quarter of this year after it started exploiting zero-day bugs.<\/p>\n<p>Although leveraging zero-day vulnerabilities is not particularly new, the emerging trend among ransomware actors to use them in large-scale attacks is significant, Akamai said.<\/p>\n<p>&#8220;Particularly concerning is the in-house development of zero-day vulnerabilities,&#8221; says Eliad Kimhy, head of Akamai security research&#8217;s CORE team. &#8220;We see this with Cl0p with their two recent major attacks, and we expect other groups to follow suit and leverage their resources to purchase and source these types of vulnerabilities.&#8221;<\/p>\n<p>In other instances, big ransomware outfits such as LockBit and ALPHV (aka BlackCat) caused havoc by jumping on newly disclosed vulnerabilities before organizations had a chance to apply the vendor&#8217;s fix for them. Examples of such &#8220;day-one&#8221; vulnerabilities include the <a href=\"https:\/\/www.darkreading.com\/remote-workforce\/attackers-abuse-papercut-rce-flaws-to-take-over-enterprise-print-servers\" target=\"_blank\" rel=\"noopener\">PaperCut vulnerabilities of April 2023<\/a> (CVE-2023-27350 and CVE-2023-27351) and vulnerabilities in VMware&#8217;s ESXi servers that the operator of the ESXiArgs campaign exploited.<\/p>\n<h2 class=\"regular-text\">Pivoting from Encryption to Exfiltration<\/h2>\n<p>Akamai also found that some ransomware operators \u2014 such as those behind the BianLian campaign \u2014 have pivoted entirely from data encryption <a href=\"https:\/\/www.darkreading.com\/risk\/bianlian-ransomware-pivots-encryption-pure-data-theft-extortion\" target=\"_blank\" rel=\"noopener\">to extortion via data theft<\/a>. The reason the switch is significant is that with data encryption, organizations had a chance of retrieving their locked data if they had a robust enough data backup and restoration process. With data theft, organizations do not have that opportunity and instead must either pay up or risk having the threat actors publicly leaking their data \u2014 or worse, selling it to others.<\/p>\n<p>The diversification of extortion techniques is notable, Kimhy says. &#8220;The exfiltration of data had started out as additional leverage that was in some ways secondary to the encryption of files,&#8221; Kimhy notes. &#8220;Nowadays we see it being used as a primary leverage for extortion, which means file backup, for example, may not be sufficient.&#8221;<\/p>\n<p>Most of the victims in Akamai&#8217;s dataset \u2014 some 65% of them, in fact \u2014 were small to midsize businesses with reported revenues of up to $50 million. Larger organizations, often perceived as the biggest ransomware targets, actually only made up 12% of the victims. Manufacturing companies experienced a disproportionate percentage of the attacks, followed by healthcare entities and financial services firms. Significantly, Akamai found that organizations that experience a ransomware attack had a very high probability of experiencing a second attack within three months of the first attack.<\/p>\n<p>It\u2019s important to emphasize that phishing is still very important to defend against, Kimhy says. At the same time, organizations need to prioritize patching of newly disclosed vulnerabilities. He adds, &#8220;[T]he same recommendations we have been making still apply, such as understanding the adversary, threat surfaces, techniques used, favored, and developed, and particularly what products, processes, and people you need to develop in order to stop a modern ransomware attack.&#8221;<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Threat actors such as the operators of the Cl0p ransomware family increasingly exploit unknown and day-one vulnerabilities in their attacks.Read More <a href=\"https:\/\/www.darkreading.com\/threat-intelligence\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-53122","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2023-08-08T02:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits\",\"datePublished\":\"2023-08-08T02:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/\"},\"wordCount\":753,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf351c09508b11ac6\\\/64d15ab9ff3cdbb730ea66a0\\\/hacker_Pira25_shutterstock.jpg\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/\",\"name\":\"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf351c09508b11ac6\\\/64d15ab9ff3cdbb730ea66a0\\\/hacker_Pira25_shutterstock.jpg\",\"datePublished\":\"2023-08-08T02:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf351c09508b11ac6\\\/64d15ab9ff3cdbb730ea66a0\\\/hacker_Pira25_shutterstock.jpg\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/bltf351c09508b11ac6\\\/64d15ab9ff3cdbb730ea66a0\\\/hacker_Pira25_shutterstock.jpg\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/","og_locale":"en_US","og_type":"article","og_title":"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2023-08-08T02:00:00+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits","datePublished":"2023-08-08T02:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/"},"wordCount":753,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/","url":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/","name":"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg","datePublished":"2023-08-08T02:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/bltf351c09508b11ac6\/64d15ab9ff3cdbb730ea66a0\/hacker_Pira25_shutterstock.jpg"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/ransomware-victims-surge-as-threat-actors-pivot-to-zero-day-exploits\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Ransomware Victims Surge as Threat Actors Pivot to Zero-Day Exploits"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/53122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=53122"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/53122\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=53122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=53122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=53122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}