In 2024, cyber threats targeting SaaS surged, with 7,000 password attacks blocked per second (just in Entra ID)—a 75% increase from last year—and phishing attempts up by 58%, causing $3.5 billion in losses (source: Microsoft Digital Defense Report 2024). SaaS attacks are increasing, with hackers often evading detection through legitimate usage patterns. The cyber threat arena saw standout players, unexpected underdogs, and relentless scorers leaving their mark on the SaaS security playing field.
As we enter 2025, security teams must prioritize SaaS security risk assessments to uncover vulnerabilities, adopt SSPM tools for continuous monitoring, and proactively defend their systems.
Here are the Cyber Threat All-Stars to watch out for—the MVPs, rising stars, and master strategists who shaped the game.
1. ShinyHunters: The Most Valuable Player
- Playstyle: Precision Shots (Cybercriminal Organization)
- Biggest Wins: Snowflake, Ticketmaster and Authy
- Notable Drama: Exploited one misconfiguration to breach 165+ organizations.
ShinyHunters swept into 2024 with a relentless spree of SaaS breaches, exposing sensitive data across platforms like Authy and Ticketmaster. Their campaign wasn’t about exploiting a vendor vulnerability—but capitalizing on one misconfiguration overlooked by Snowflake customers. As a result, ShinyHunters could infiltrate, exfiltrate, and blackmail these snowflake users without enforcing MFA and properly securing their SaaS environments.
🏀 Behind the Play: ShinyHunters operated like all-stars of the dark web, effortlessly taking advantage of SaaS misconfigurations. Their stolen data dumps weren’t quiet affairs—they were daring theatrical releases featuring bidding wars and exclusive leaks. The Snowflake breach alone triggered widespread panic as credentials snowballed into widespread vulnerabilities across critical systems.
💡SaaS Security Lessons: The Snowflake campaign exposed critical client-side security oversights, not vendor failures. Organizations failed to enforce MFA, rotate credentials regularly, and implement allow lists, leaving systems vulnerable to unauthorized access.
2. ALPHV (BlackCat): The Master of Deception
- Playstyle: Strategic Maneuvering (Ransomware-as-a-Service, RaaS)
- Biggest Wins: Change Healthcare, Prudential (Healthcare & Finance)
- Notable Drama: The $22M exit scam scandal with RansomHub.
ALPHV, aka BlackCat, played one of the year’s boldest moves in 2024. After extorting $22 million from Change Healthcare through compromised credentials, the group, in a very ballsy move, faked an FBI takedown on their leak site to mislead both authorities and affiliates. But the real drama began when RansomHub, an affiliate, publicly accused ALPHV of taking the ransom and leaving them empty-handed, even sharing a Bitcoin transaction as proof. Even with the betrayal, the affiliate published the stolen data, leaving Change Healthcare with the ransom paid and the data lost.
🏀 Behind the Play: The fallout between ALPHV and RansomHub played out like a cybercrime soap opera, with conflicting stories and heated accusations across dark web forums. Despite the chaos, ALPHV’s attacks on Prudential and others solidified their reputation as one of the year’s most formidable ransomware players.
💡SaaS Security Lessons: For prevention, track credential leaks with darknet monitoring and enforce Single Sign-On (SSO) to streamline authentication and reduce credential risks. For detection and response, follow authentication activities, detect compromised credentials early, and apply account suspension policies to prevent brute-force attacks.
3. RansomHub: Rookie of the Year
- Playstyle: Opportunistic Offense (Ransomware-as-a-Service, RaaS)
- Biggest Win: Frontier Communications (Telecom & Infrastructure)
- Notable Drama: Caught in the fallout of ALPHV’s $22M scam.
RansomHub rose from the ashes of Knight Ransomware in early 2024 as one of the most active ransomware actors. Known for their opportunistic tactics, they made headlines with their affiliation with ALPHV (BlackCat). Their role in the Change Healthcare breach impacted over 100 million U.S. citizens, highlighting their ability to exploit SaaS vulnerabilities, including misconfigurations, weak authentication, and third-party integrations, maximizing their reach and impact.
🏀 Behind the Play: After being benched by ALPHV and losing their cut of the $22 million ransom from the Change Healthcare breach, RansomHub still held onto the stolen data—a powerful play that kept them in the game. Despite the betrayal, this rookie threat actor hit the court with renewed determination, scoring high-profile breaches throughout the year, including Frontier Communications. They are adamant about staying in the ransomware league, even after a rough first season.
💡SaaS Security Lessons: Stay alert of phishing attempts that exploit stolen personal information to create more convincing attacks. Implement identity threat detection tools to monitor for signs of account takeovers and anomalies in user activities, enabling timely identification and response to potential breaches.
4. LockBit: Clutch Player of the Year
- Playstyle: Relentless Offense (Ransomware-as-a-Service, RaaS)
- Biggest Wins: Supply chain effect from Evolve Bank & Trust (Fintech)
- Notable Drama: FBI’s Operation Cronos failed to shut them down entirely.
LockBit dominates the ransomware court, relentlessly scoring breach after breach despite the ongoing efforts by the FBI and NCA to dismantle their infrastructure, kind of like Steph Curry–consistently performing well when there’s a lot on the line. High-profile plays against Fintech companies, such as Evolve Bank & Trust, with the supply chain effecting more companies such as Affirm and Wise, solidified LockBit’s status as the most consistent offensive player in the SaaS attack league.
🏀 Behind the Play: Although Operation ‘Cronos’ disrupted their servers and seized critical infrastructure, the group bounced back with resolve, taunting authorities on their leak site with bold claims like, “You can’t stop me.” In December 2024, we saw updates on an earlier arrest of an alleged LockBit developer— highlighting the ongoing nature of Operation ‘Cronos’, signaling that this global sting is far from over.
💡SaaS Security Lessons: Prioritize third-party vendor risk assessments and maintain visibility into SaaS app connectivity to detect exploitation pathways early. Use activity monitoring tools with threat detection, UEBA (User and Entity Behavior Analytics), and anomaly detection to spot suspicious behavior in real time.
5. Midnight Blizzard (APT29): The Silent Operator
- Playstyle: Defensive Infiltration (Advanced Persistent Threat, APT)
- Biggest Win: TeamViewer (Remote Access Tool)
- Notable Drama: A breach as a gateway for silent espionage.
When it comes to state-sponsored espionage, Midnight Blizzard—aka APT29—plays like Kawhi Leonard running a flawless defensive play, quietly intercepting data and making strategic moves without drawing attention. This group, backed by Russian state resources, specializes in hacking critical systems, with TeamViewer standing out in 2024. This group isn’t flashy—they don’t drop ransom notes or brag in dark web forums. Instead, they quietly exfiltrate sensitive data, leaving digital footprints so faint they’re nearly impossible to trace. Unlike ransomware groups, state-sponsored actors like Midnight Blizzard focus on cyber espionage, working discreetly to gather intelligence without triggering any alarms.
🏀 Behind the Play: Midnight Blizzard doesn’t play for quick wins—they infiltrate, wait, and watch. Using state-level tactics, they remain hidden within networks for months, if not years, extracting valuable intelligence without raising any alarms. While the company ultimately contained the TeamViewer breach, the target’s nature reveals Midnight Blizzard’s intent—focusing on high-value organizations with extensive usage, aiming to exploit these footholds as launchpads for broader attacks on downstream targets.
💡SaaS Security Lessons: Stay vigilant for breaches in critical SaaS applications, often targeted by nation-state actors. Perform regular configuration audits to reduce risks and ensure secure access controls such as multi-factor authentication (MFA). Proactive auditing helps minimize breach impact and limits exploitation pathways.
The Sixth Man: The One to Watch and the Benched Talent
- Hellcat (The Ones to Watch): A ransomware group that burst onto the scene in late 2024, scoring a confirmed hit on Schneider Electric. Their rapid emergence and initial success signal potential for a more aggressive playbook in 2025.
- Scattered Spider (Benched Talent): Once a major player in cybercrime, this hybrid social engineering group now sits on the bench following arrests and legal crackdowns. While their activity slowed, experts caution it’s too early to count them out.
Both groups are worth keeping an eye on—one for its momentum, the other for its reputation and potential comeback story.
🔑 Key Takeaways for 2025:
- Misconfigurations Remain a Prime Target: Threat actors continue to exploit overlooked SaaS misconfigurations, gaining access to critical systems and sensitive data. Regular audits, enforced MFA, and credential rotation are essential defenses.
- Identity Infrastructure Under Attack: Attackers leverage stolen credentials, API manipulations, and stealthy exfiltration to bypass defenses. Monitoring for leaked credentials, having strong MFA enforcement, anomaly detection, and identity monitoring are critical to preventing breaches.
- Shadow IT and Supply Chain as Entry Points: Unauthorized SaaS applications and app-to-app integrations create hidden vulnerabilities. Continuous monitoring, proactive oversight, and automated remediation are essential for reducing risk exposure.
The foundation of a multi-layer SaaS security solution begins with automated continuous risk assessments and the integration of ongoing monitoring tools into your security management.
This isn’t their last dance. Security teams must stay informed, vigilant, and gear up for another year of defending against the world’s most prolific threat actors.
Don’t wait for the next breach.
Get your SaaS Security Risk Assessment today.
Found this article interesting? This article is a contributed piece from one of our valued partners. Follow us on Twitter and LinkedIn to read more exclusive content we post.
