Analyzing the 2025 APJ eCrime Landscape Report: A Deep Dive into AI-Driven Ransomware and Cybercrime Marketplaces

The 2025 APJ eCrime Landscape Report from CrowdStrike reveals a concerning uptick in AI-driven ransomware attacks and persistent activity within decentralized Chinese-language cybercrime marketplaces across the Asia Pacific and Japan (APJ) region. This report provides a comprehensive examination of how advancements in artificial intelligence (AI) and the evolving infrastructure of cybercriminal activity are shaping the threat landscape.

The Surge of AI-Enhanced Ransomware

One of the standout findings of the report is the significant rise of AI-accelerated ransomware. This type of cyberattack primarily targets high-value organizations in countries like India, Australia, and Japan. Employing AI-enhanced social engineering techniques and the creation of automated malware has led to attacks that are not only more frequent but also more sophisticated.

Adam Meyers, Head of Counter Adversary Operations at CrowdStrike, highlights a crucial aspect of this development: “AI-developed malware enables adversaries to launch high-velocity, high-volume attacks.” The increased speed and efficiency of these attacks pose a substantial risk, as adversaries can inflict damage rapidly.

The report details the role of Ransomware-as-a-Service (RaaS) providers, such as KillSec and Funklocker, who utilize AI-developed malware. These groups were responsible for over 120 ransomware incidents across various sectors, including manufacturing and finance, with a striking total of 763 victims reported on public leak sites. This illustrates the widespread impact of these attacks and emphasizes the need for robust cyber defenses.

The Dynamics of Chinese Cybercrime Marketplaces

Amidst crackdowns by Chinese authorities, cybercriminals continue to thrive in anonymous, decentralized marketplaces. The report identifies notable forums like Chang’an, FreeCity, and Huione Guarantee, where transactions are facilitated across multiple platforms, including the clearnet, darknet, and even Telegram.

Before its disruption in 2025, the Huione Guarantee marketplace alone processed an estimated USD $27 billion in illicit transactions. The decentralized structure of these forums allows cybercriminals to buy and sell stolen credentials, phishing kits, and malware, all while maintaining operational security (OPSEC) that complicates tracking and prosecution efforts.

The anonymity granted by these decentralized platforms underscores the resilience of these Chinese-speaking threat actors, who continue to evade law enforcement despite heightened scrutiny.

Financial Manipulation Campaigns on the Rise

Another alarming trend highlighted in the report is the coordinated account takeover campaigns that specifically target Japanese securities trading accounts. These attacks, attributed to Chinese-speaking threat actors, facilitate artificial inflation of thinly traded Chinese stocks, akin to what’s known as a “pump-and-dump” scheme.

Using shared phishing infrastructure, attackers can quickly gather victim information, which is then sold on various forums, including the Chang’an Marketplace. This systemic exploitation not only harms individual investors but also undermines the integrity of financial markets.

Supporting Services: The Industrialization of Cybercrime

The report also sheds light on the acceleration of supporting cybercrime service providers across the APJ region. Notable players include CDNCLOUD, known for its bulletproof hosting; Magical Cat, which specializes in Phishing-as-a-Service; and Graves International SMS, focused on global spamming services. These providers enable the broader distribution of phishing attacks and facilitate the monetization of stolen data.

Moreover, remote access tools like ChangemeRAT, ElseRAT, and WhiteFoxRAT continue to target both Chinese- and Japanese-speaking users. Attackers employ tactics such as SEO poisoning, deceptive advertising, and phishing disguised as legitimate purchase orders to compromise their targets effectively.

A Call to Action for Defenders

In light of these troubling findings, CrowdStrike emphasizes the urgent need for a robust response to the evolving threat landscape. Adam Meyers states, “eCrime actors are industrializing cybercrime across APJ through thriving underground markets and complex ransomware operations.” He stresses that defenders must rise to the challenge, leveraging AI innovations, human insights, and unified responses to counter these escalating threats.

The combination of rapidly evolving AI, decentralized marketplaces, and a growing cybercrime service economy presents ongoing challenges for organizations in the region. The insights from the 2025 APJ eCrime Landscape Report underscore the critical need for vigilance and proactive measures in the face of an increasingly sophisticated cyber threat landscape.