The State of Cybercrime in 2025 (with Nick Ascoli!)

The State of Cybercrime in 2025 (with Nick Ascoli!)

by John Hammond

Humanities, Social Sciences & Thought Law & Justice LNQDigital, IT and Communications lawLNQEComputer crime, cybercrime
🎙 John Hammond 👥 2.2M 📅 November 15, 2025 ⏱ 43 min 👁 12K 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

cybercrimestealer logsMFAbreach forumsextortion

Summary

In this joint Discord Live event, John Hammond and Nick Ascoli, Director of Product Research at Flare, discuss the state of cybercrime in 2025. They highlight key trends: an increase in credential-based attacks, the growing use of stealer logs and ULPs (URL:login:password lists), and the shift from free leaks to extortion-driven operations. They note the decline of major English-speaking cybercrime forums like Breach Forums, Nulled, and Cracked, which have been seized or taken down, leading to a more fragmented landscape. They also discuss significant law enforcement actions, including Operation Talent and Operation Secure, and the arrests of individuals associated with groups like Shiny Hunters, Lapsus$, and Scattered Spider. The conversation covers the role of MFA and its limitations, the use of cookies to bypass it, and the increasing professionalism of cybercriminal operations. They emphasize that stealer logs are the backbone of cybercrime, used for credential stuffing, phishing, and initial access. The discussion also touches on the cultural shift from ‘hacking for the culture’ to profit-driven extortion, and the impact of arrests on the cybercrime ecosystem.

175 words

Critical Evaluation

Value of the Information & Strength of the Argument

The video provides valuable insights into the current cybercrime landscape, with specific examples and trends that are not widely covered in mainstream media. The argumentation is based on the speakers’ professional experience and observations, which adds credibility. They support their claims with references to specific incidents, such as the Snowflake attacks and the arrest of Medusa stealer operators. However, the discussion is largely anecdotal and lacks rigorous data or citations, which limits its scientific value. The speakers also engage in casual banter, which may detract from the seriousness of the topic but does not undermine the core content.

Scientific Rigor, Source Quality, Title Accuracy

The speakers reference several sources, including the DBIR (Verizon Data Breach Investigations Report) and specific law enforcement operations, but they do not provide direct citations or URLs. The title accurately reflects the content, which is a discussion on the state of cybercrime. The video is a casual conversation rather than a formal presentation, which affects the rigor of the sources. The speakers are knowledgeable and appear to be credible, but the lack of formal references and the informal setting reduce the overall scientific rigor.

197 words

Title / Content Match

The title accurately reflects the content, which is a discussion on the state of cybercrime in 2025, covering trends, forums, and arrests.

Quality & Reliability

8/10

The video features two cybersecurity experts discussing current trends in cybercrime, referencing specific incidents, operations, and reports (e.g., DBIR). The information is anecdotal and based on professional experience, but lacks detailed citations. The discussion is coherent and aligns with known public reports, but the lack of formal references reduces the score.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • Just Hacking Training — Mentioned as a resource for learning cybersecurity.
  • CodeCrafters — Affiliate link for learning to code.
  • CyberDefenders — Affiliate link for blue team training and SOC analyst certifications.
  • OpenVPN — Affiliate link for hosting a VPN.
  • Newsletter — Link to John Hammond's newsletter.

Concurring Sources

  • Verizon Data Breach Investigations Report — The video references the DBIR to support claims about credential attacks and stealer logs.
  • CISA Advisory on Scattered Spider — Provides official information on Scattered Spider, a group discussed in the video.

Dissenting Sources

  • None — No discordant sources were identified in the video.

Contribution & Novelties

The video provides a unique insider perspective on the current state of cybercrime, highlighting the shift from forum-based to more fragmented communication channels, the increasing use of stealer logs, and the impact of law enforcement actions. It offers practical insights for cybersecurity professionals, such as the importance of monitoring stealer logs and the limitations of MFA. The discussion also sheds light on the cultural aspects of cybercrime communities.

Pour aller plus loin :

  • Verizon Data Breach Investigations Report (DBIR) — The DBIR is referenced in the video and provides comprehensive data on data breaches and cybercrime trends.
  • Operation Talent — A law enforcement operation mentioned in the video that led to the seizure of cybercrime forums.
  • Operation Secure — Another operation mentioned, targeting infostealer malware.
  • Scattered Spider — A group discussed in the video; CISA advisory provides more information.
  • Shiny Hunters — News article about the arrests of Shiny Hunters members.

151 words

Radar Profile

The radar profile shows high scores in quantity of information and fiabilité globale, reflecting the depth of discussion and the credibility of the speakers. The niveau technique is moderate, indicating that the content is accessible to a general audience but still provides technical insights. The overall balance suggests a valuable resource for understanding cybercrime trends.

Reliability 7/10

💬 No comments were provided for analysis.