How Cybersecurity Experts Track the Changing Threat Group Landscape

Threat groups are getting harder to describe with simple labels like hacker, criminal or state actor, because their tactics, tools and goals overlap. Security teams need context. They need to know how attackers operate, what they target and how fast their methods change.

That’s why expert analysis matters. Naming groups is only useful if it helps defenders prepare, whether that’s protecting critical infrastructure, stopping identity abuse or closing the gaps attackers keep exploiting.

Who is behind today’s attacks

Many of today’s hacking groups are professional operations, some backed by governments and others run like businesses. University of Cincinnati cybersecurity experts made that point in May 2025, when local media asked them about the ransomware attack on Kettering Health.

“These are not your basement hooded hackers,” said Richard Harknett, co-director of the Ohio Cyber Range Institute. He said the number of cyber gangs specializing in ransomware has nearly doubled in the last two years. Quotes in an earlier version of this article attributed to a UC expert named “Simons” could not be found in UC’s published coverage and have been removed.

Attackers adopt AI

Attackers are adopting artificial intelligence and machine learning. They use it to speed up reconnaissance and find weak spots faster.

Defenders use the same tools. The contest is about speed.

What AI changes

AI-assisted attacks can adjust quickly to defenses, which makes them harder to spot. Finance, healthcare and national defense all face the risk.

Why hospitals and infrastructure get hit

Critical services are frequent targets. Harknett said health care providers are preferred targets because “they have a lot of valuable data, a lot of personal data. But they also have urgency.” Attackers know a hospital that can’t wait is more likely to pay.

Jacques Bou Abdo, an assistant professor at UC’s School of IT, told WLWT that hospitals have often paid ransoms because “it’s just not the data that’s important, it’s the medical record of patients.”

What defenders can do

Harknett described the goal as cyber-resiliency: how quickly an organization can get its operations back up after an attack. Bou Abdo suggested stronger legal requirements for cyber protections to help prevent future attacks. Training more skilled people helps too.

Both experts point to the same thing. Prepare to recover, not just to defend.

What threat tracking is for

Tracking threat groups is useful when it changes what defenders do. Knowing that ransomware gangs are multiplying, and that they pick targets under time pressure, tells hospitals and infrastructure operators where to invest first.

For most organizations, that means tested backups, a rehearsed incident plan and a clear idea of which systems have to come back first.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.