2025-12-12 Session hijacking is stealing an active session ID after login (often via XSS/malware) to impersonate a user. Session fixation is tricking a user into authenticating with a predetermined session ID. Both are risks from poor session management. Regenerating session IDs after login is key to prevention.
Continue reading2025-12-05 Ransomware attacks surged 47% through Q3 2025, reaching 6,330 cases. The US, SMBs, and the manufacturing sector remain the top targets. This rise is fueled by Ransomware-as-a-Service (RaaS) and led by groups like Qilin, emphasizing the need for stronger employee training and data backup.
Continue reading
This article provides an overview of dark web browsers, explaining what they are and why they are used. It clarifies the distinction between the “dark web” and the “deep web,” and describes how these specialized browsers enable users to access a hidden part of the internet with enhanced privacy and anonymity.
A dark web browser is a specific type of web browser designed to navigate the dark web. It provides anonymity by routing internet traffic through a series of random relays, or “nodes,” which hides a user’s IP address and location. The most well-known example of this is the Tor Browser, which stands for “The Onion Router.” The name “onion router” comes from the layered encryption process, where each layer of a user’s connection is peeled back like an onion as it passes through different nodes.
It is a common misconception that the dark web and the deep web are the same. The article clarifies this distinction:
The article highlights a few of the most popular dark web browsers:
For organizations, monitoring the dark web is a critical component of a proactive threat intelligence strategy. It allows security teams to identify if their company’s data, such as credentials or sensitive information, is being sold or discussed on illicit forums. Threat intelligence platforms, like NordStellar, can help automate this process, providing alerts and insights to protect against potential breaches.
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Research: Ransomware Attacks Spiked by 49% in the First Half of 2025
A startling 49% surge in ransomware attacks marked the first half of 2025, with cybercriminals increasingly targeting U.S. organizations and small to medium-sized businesses (SMBs). Our latest research reveals that between January and June 2025, ransomware groups exposed 4,198 cases on the dark web—a dramatic increase from the 2,809 cases recorded during the same period in 2024.
So, what forces are driving this alarming trend, who are the primary targets, and what can organizations do to defend themselves?
Why the Sudden Increase? The Forces Driving the Ransomware Boom
The profitability and effectiveness of ransomware have emboldened cybercriminals to intensify their efforts. Vakaris Noreika, a cybersecurity expert at NordStellar, identifies three key factors contributing to the growth:
"Factors contributing to the growth in ransomware attacks include the rise in ransomware-as-a-service (RaaS), expanded attack surfaces from remote or hybrid work models, and economic uncertainty that could encourage more people to turn to cybercrime."
Let's break down these drivers:
In a typical modern attack, criminals don't just encrypt files; they exfiltrate sensitive data and threaten to publish it if the ransom isn't paid, adding a layer of public pressure. Even if a ransom is paid, there is no guarantee that attackers will provide a decryption key, and they may demand a second payment, leaving victims with severe financial, reputational, and legal damage.
The Prime Targets of Q2 2025
Our analysis of 1,758 ransomware incidents from April to June 2025 reveals clear patterns in targeting.
The U.S. is a prime target
The U.S. Remains in the Crosshairs Of the cases traced to a specific country, U.S. businesses were hit hardest, accounting for a staggering 49% of all attacks (596 incidents). Germany followed at a distant second with 84 cases, trailed by Canada (74) and the United Kingdom (40). The U.S. is a prime target due to its concentration of profitable businesses, which attackers believe are more likely to pay a ransom to avoid reputational damage and operational downtime.
The Manufacturing Industry Under Siege
製造業是受影響最嚴重的行業，共錄得 229 宗案件The manufacturing sector was the most affected industry, with 229 recorded cases. It was followed by construction (97 cases) and information technology (88 cases). Manufacturing companies are often vulnerable because they struggle to centralize security across geographically dispersed locations and frequently rely on outdated, unpatched operational technology systems.
SMBs: The Most Vulnerable Target
Small to medium-sized businesses were the primary victims. Organizations with 51–200 employees and revenues between $5 million and $25 million experienced the most attacks.
"The victim profile mirrors data from Q1 2025, with SMBs and manufacturing companies remaining the prime targets," notes Noreika. "This is a significant cause for concern because bad actors continue successfully exploiting preventable security vulnerabilities."
Like manufacturing firms, SMBs often have limited budgets for cybersecurity and may rely on third-party IT providers, leaving them exposed.
Who Is Responsible for the Attacks?
The ransomware landscape is dominated by a few highly active groups operating on a RaaS model.
Building a Ransomware-Resistant Business
As ransomware attacks persist, a proactive defense strategy is essential.
"Aside from raising cybersecurity awareness, companies should build a comprehensive cybersecurity strategy to detect threats before they escalate," advises Noreika. "This includes implementing endpoint protection, monitoring the dark web for potential data leaks, and keeping a close eye on the company's attack surface for unpatched security vulnerabilities."
Key defensive measures include:
About the Methodology
We continuously monitor over 200 dark web blogs operated by ransomware groups to collect data on victim organizations. Once a company is identified, we use publicly accessible business data sources to gather firmographic information, such as industry, size, and location. The total number of attacks is accurate, though figures in categorized breakdowns may be slightly higher due to a smaller sample size where full firmographic data was available.
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products. Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Summary: Omnisend, a leading provider of marketing automation technology, now leverages NordStellar to proactively monitor and mitigate external threats before they escalate.
As a provider of a marketing automation platform used by over 150,000 online stores worldwide, Omnisend must stay ahead of cyber threats at all times. To achieve this, the company relies on solutions like NordStellar.
Industry: Marketing technology
Challenge: Limited visibility into external cyber threats and dark web exposure
Solution: NordStellar threat exposure management platform
Results:
Omnisend provides a cutting-edge marketing automation platform for e-commerce brands, dedicated primarily to email and SMS marketing. The company’s solution is used by over 150,000 online shops worldwide. In 2022, Omnisend was ranked #77 in the Financial Times ranking of Europe’s 1000 fastest-growing companies, and earned the #44 spot in the Deloitte UKFast50 for the third consecutive year.
While Omnisend already had several protective measures in place to ensure strong protection of its data and infrastructure, some threats remained under the radar. This was due to the company’s limited visibility into areas such as the dark web. As a result, Omnisend didn’t have the means to monitor leaked company credentials or data compromised by malware.
The company decided to address this after its team attended a live demo of NordStellar, where the platform was used to assess their threat exposure using actual company data. The results were eye-opening. Once they saw what kind of information NordStellar was able to uncover about their business on the dark web, they decided to take appropriate action. In their own words: “Like any professional security team with high standards, we couldn’t just walk away from such findings.”
Shortly after the demo, Omnisend decided to move forward with the NordStellar platform. The decision was based on three factors:
The company was most impressed with NordStellar’s ability to detect leaks involving employee credentials, a threat vector that often goes unnoticed. Omnisend also praised the platform for providing clear, practical feedback that the team could act on right away, rather than just basic notifications.
To gain insights into external threats targeting the company, Omnisend is making full use of all NordStellar’s features, including:
NordStellar delivers findings that include risk levels and contextual information about security events to help Omnisend better understand the specific circumstances surrounding each incident. As a result, it significantly improves the company’s cybersecurity posture and threat response.
The findings provided by NordStellar help Omnisend’s security team prioritize their tasks and dedicate more attention to other urgent issues. As Žygimantas Stauga, Director of Information Security at Omnisend, said, “There is always an issue to address, but resources are limited. That’s why it’s crucial to prioritize tasks when planning security activities. Insights from NordStellar help us do exactly that.”
NordStellar has also helped the company uncover the root cause of a past security incident. Although the issue had already been handled, the team wasn’t sure exactly what had caused it. Thanks to NordStellar, they discovered it was malware. This revelation had a big impact on the company’s processes and led to important changes in its threat response strategy.
Today, instead of guessing if there’s any trouble, NordStellar immediately notifies Omnisend whenever external threats require their attention. With this information, the company can mitigate risks before they escalate.
“NordStellar is the missing puzzle piece in most organizations’ cybersecurity, catching threats that slip past other defenses.”
Žygimantas Stauga, Director of Information Security at Omnisend
Curious what hackers might know about your business? See NordStellar in action—book a demo with us and learn about the risks you’re probably unaware of.
NordStellar is a threat exposure management platform that enables enterprises to detect and respond to network threats before they escalate. As a platform and API provider, NordStellar can provide insight into threat actors’ activities and their handling of compromised data. Designed by Nord Security, the company renowned for its globally acclaimed digital privacy tool NordVPN.
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
Click one of our contacts below to chat on WhatsApp
