Dark web threads discussing crypto-drainers – malware designed to swiftly drain cryptocurrency wallets – saw a significant rise in 2024, as revealed by the latest Kaspersky Security Bulletin. Kaspersky also reported a 40% spike in corporate database ads on a prominent dark web forum, highlighting cybercriminals’ growing focus on data breaches.

Additional trends include a shift of cybercriminals from Telegram back to forums, the proliferation of stealers and drainers via Malware-as-a-Service, a rise in various types of cyberthreats targeting the Middle East, and more.

A surge in interest for crypto-drainers

In 2024, Kaspersky Digital Footprint Intelligence experts saw a notable surge of interest in crypto-drainers across dark web markets. A drainer is a type of malware that emerged around three years ago and is designed to trick its victims into authorising fraudulent transactions to steal funds from their wallets.

Common methods include fake airdrops, phishing sites, malicious browser extensions, deceptive ads, malicious smart contracts, and fake NFT marketplaces.

The number of dark web threads discussing drainers increased by 135%, from just 55 in 2022 to 129 in 2024. In these threads, cybercriminals discuss various topics, ranging from buying and selling this type of malicious software to assembling teams for distribution, and beyond.

“In light of this trend, the interest of cybercriminals in crypto-drainers and related attacks is likely to grow further in 2025,” says Alexander Zabrovsky, a security expert at Kaspersky Digital Footprint Intelligence. “This means crypto enthusiasts need to be more vigilant than ever, adopting robust crypto security measures.

“Meanwhile, companies should focus on educating their customers and employees while actively monitoring their online presence to reduce the risk of successful attacks. Drainers often employ social engineering tactics to ultimately steal funds. They may be exploiting well-known wallet and exchange brands to lure victims into revealing their wallet information or making fraudulent transactions.

Regularly searching for brand mentions on search engines, social media, and marketplaces is essential. If any phishing or fraudulent sites are identified, they can be taken down promptly, preventing potential victims from falling prey to these scams. Utilising dedicated tools can greatly enhance this monitoring process.”

The rise in advertisements for alleged data breaches

Other threats expected to gain momentum in 2025, include data breaches and leaks. Kaspersky researchers have observed a rise in corporate database advertisements on one of the popular shadow forums.

Specifically, the number of posts buying and selling databases increased by 40% between August and November 2024, compared to the same period the previous year. While some of this growth may partially stem from reposting of older leaks, cybercriminals are clearly interested in distributing leaked data – whether new or old.

“Not every advertisement of a data breach on the dark web stems from a genuine incident. Some ‘offers’ may simply be well-marketed materials. For example, certain databases might combine publicly available information or previously leaked data, presenting it as breaking news.

By making such claims, cybercriminals can generate publicity, create buzz, and tarnish the reputation of the targeted company simply by announcing a data breach. This underscores the growing importance of monitoring corporate mentions and assets on the dark market, allowing for proactive defense and immediate response,” elaborated Zabrovsky.

Given the rising trend of supply chain and similar attacks, 2025 is anticipated to witness an increase in data breaches overall, particularly those stemming from attacks on major companies’ contractors.

Other emerging trends on the dark web market in 2025 include:

• Escalating threat landscape in the Middle East: The region is witnessing an increase in hacktivism driven by ongoing geopolitical tensions. If these tensions do not subside in 2025, hacktivism is expected to intensify further. Furthermore, Kaspersky experts anticipate a continued rise in ransomware attacks in the Middle East, given that the number of ransomware victims increased from an average of 28 per half-year in 2022-2023 to 45 in the first half of 2024.
• Migration from Telegram to dark web forums: Despite a spike in cybercriminal activity on Telegram in 2024, the shadow community is expected to shift back to forums. Telegram channels are increasingly being banned, as reported by their administrators, driving this migration.
• Increase in high-profile law enforcement operations against cybercrime groups: 2024 was a significant year in the global high-profile fight against cybercrime. Kaspersky experts anticipate that 2025 will bring an increase in arrests and takedowns of cybercriminal group infrastructures and forums that receive publicity. In turn, in response to the successful operations of 2024, threat actors are likely to shift their tactics, migrating to invitation-only forums.
• Fragmentation of ransomware groups: Ransomware groups may fragment into smaller, independent units, making them harder to track. This decentralisation allows cybercriminals to operate more flexibly while staying under the radar of law enforcement and cybersecurity firms.
• Stealers and drainers will likely see a rise in promotion via Malware-as-a-Service model: Moreover, various data and credentials stolen with the use of these types of malware are expected to be increasingly sold on shadow forums.

Nigeria Immigration Service (NIS) has announced an ongoing upgrade and maintenance of its passport portal for applicants within Nigeria.

In a public notice shared on Sunday via its official ‘X’ page, the NIS reassured Nigerians that other services, including passport applications for citizens abroad, remain fully operational during the maintenance period.

The service stated that its team is “working tirelessly” to complete the upgrade and restore full functionality within 72 hours.

“We sincerely apologise for any inconvenience this may cause and deeply appreciate your patience and understanding,” the notice read. It emphasized that the upgrade is part of efforts to enhance service delivery.

Reaffirming its commitment to excellence, the NIS pledged to provide efficient services to Nigerians at home and abroad.

FBNQuest Asset Management, a subsidiary of FBN Holdings Plc., has been awarded an A+ rating by Agusto & Co. Limited. This rating reflects the firm’s stable outlook, robust risk management, and strong investment capabilities, highlighting its impressive operational performance and outstanding business profile.

It emphasizes FBNQuest Asset Management’s ongoing commitment to providing exceptional investment services to its clients.

The rating was issued in a recent report by Agusto & Co., a leading rating agency in Nigeria. This recognition underscores the company’s strong operational record, excellent corporate governance, and professional management of fund assets.

The organisation’s impressive performance demonstrates its unwavering dedication to delivering exceptional value to clients through a variety of products and services tailored to meet their investment needs.

Ike Onyia, the Managing Director of FBNQuest Asset Management, expressed his satisfaction with the rating, stating, “We are truly delighted to receive the A+ rating from Agusto & Co. This recognition is a testament to our strong expertise in investment portfolio management and the achievements we have realised over the years.

“We take pride in this positive acknowledgement, which stems from our well-thought-out business strategies and the exceptional performance of our skilled workforce, cementing our position in the hearts of our stakeholders.”

FBNQuest Asset Management was also recognised as the Best Asset Manager at the 2024 EMEA African Banker Awards. The organisation continues to maintain a consistently strong position in the investment services subsector in Nigeria, leveraging its rich pedigree in intellectual capital, strong research capabilities, and cutting-edge technology to provide clients with value-adding insights, advice, and service.

“Our mutual funds offer diverse investment options that enable the creation of unique and value-enhancing investment strategies for different client segments.

Additionally, our range of mutual funds encompasses various asset classes, including equities, bonds, and money market instruments,” he added.

Agusto & Co. is a Pan-African leader in credit ratings and credit reports, having assigned over 1,500 ratings across various sectors. Their ratings are globally recognised, with a broad client base relying on them as benchmarks to gauge business success.