Lazarus Group Deploys Kaolin RAT via Spear-Phishing Attacks Worldwide

The German Cyber Criminal Überfall has resulted in a 92% growth in data leaks, tripling the European average for 2025, with non-English-speaking nations remaining primary targets for global extortion groups. Established brands like LockBit have been disrupted, rebalancing the ecosystem into a crowded field of agile data leak sites such as SafePay and Qilin. These groups are hitting Germany in lockstep with their global expansion, identifying the Mittelstand and German professional services as high-volume, target-rich environments. The disruption has shifted the European threat landscape going into 2026, with smaller organizations remaining critical pivot points for those aiming at the top of the industrial stack.