Ransomware 2025: Statistics, Trends & Major Incidents

What is Ransomware?

It is likely the worst nightmare to discover that files on your PC are encrypted. You were checking your mailbox and clicking on the attached files to see what they contained. The strange file, which had nothing but offered to enable macros, was not looking suspicious. But suddenly, less than 15 minutes after you open that document, you see that all files on your PC have strange extensions, and at least one readme.txt file is inside each folder. How did it happen?

The short definition of ransomware is hidden in its name, just like in many other viruses. “Ransom software” is a program that injects into your computer, encrypts your files, and then asks you to pay the ransom to get your files back. Some examples of ransomware can threaten their victims that they will delete your files or publish some sensitive data if you do not pay the ransom. While the first hazard is a 100% lie, the second thesis can be real since ransomware is often spread with spyware or stealers.

For every victim, ransomware generates a unique online key. That key is stored on the server maintained by cybercriminals. If the virus cannot connect to that server, it encrypts the files with the offline key, which is stored locally on the encrypted machine. The amount of offline keys is limited. Hence, you have a decryption key in common with several other victims.

Unfortunately, there is no 100% guarantee of getting your files back. If you are lucky enough and ransomware uses the offline key, you can decrypt your data much faster. Nonetheless, obtaining keys is quite long, and you may have to wait several weeks. The decryption app, which is supposed to be used for file decryption, will receive the update with the key that fits you as soon as analysts find it.

Online keys are much harder to solve. Since every such key is unique, you may wait for months. Ransomware distributors will likely be caught and forced to uncover all keys they have on the servers. Another case when all keys are released to the public is when ransomware creators decide to shut down their malicious activity. Such a situation was only once - in 2018 when GandCrab developers claimed that they earned 2 billion dollars and suspended their activity.

Ransomware in 2025: Statistics & Overview

The ransomware threat landscape in 2025 has reached unprecedented levels of sophistication and impact. Based on comprehensive analysis of incidents from January through September 2025, the cybersecurity community is witnessing a dramatic escalation in both the frequency and severity of ransomware attacks.

Key Statistics (January–September 2025)

• 4,701 incidents reported globally (+46% compared to the same period in 2024)
• 2,332 attacks (50%) targeted critical infrastructure (+34% year-over-year)
• United States accounts for 21% of all global cases, followed by Canada (8%) and the United Kingdom (6%)
• $2 million average ransom demand (increased from $400,000 in 2023)
• $1.53 million average recovery cost excluding ransom payment (–44% from 2024)
• Only 40% of victims involved law enforcement (down from 52% in 2024)
• 49% of victims with encrypted data paid the ransom (down from 70% in 2024)

Key Trends in 2025

The ransomware ecosystem has evolved significantly in 2025, with threat actors adopting increasingly aggressive and technologically advanced tactics. Here are the most significant trends shaping the current threat landscape:

Attack Tactics & Entry Vectors

Understanding how ransomware operators gain initial access and execute their attacks is crucial for developing effective defenses. In 2025, attackers are employing a sophisticated mix of technical exploits and social engineering.

Primary Entry Vectors

• 32% — Vulnerability exploitation (unpatched VPN appliances, outdated content management systems)
• 23% — Stolen credentials (obtained via info-stealers and phishing campaigns)
• 18% — Phishing emails (increased from 11% in 2024, reflecting improved AI-generated content)
• Living-off-the-Land (LotL) techniques — Abuse of built-in Windows utilities and BYOVD (Bring Your Own Vulnerable Driver) to disable endpoint detection and response (EDR) solutions
• Legitimate tool attacks — Exploitation of RMM solutions and cloud storage services (OneDrive, Dropbox) for ransomware deployment without traditional malware binaries

Advanced Tactics Employed in 2025

Major Ransomware Incidents in 2025

2025 has seen several high-profile ransomware attacks affecting critical infrastructure, healthcare systems, educational institutions, and major corporations worldwide. The following timeline highlights the most significant incidents:

Geographic & Industry Distribution

Ransomware attacks in 2025 continue to show distinct geographic and sectoral patterns, with certain regions and industries bearing disproportionate risk.

Geographic Distribution (January–September 2025)

Most Targeted Industries

• Manufacturing — 660 attacks
• Real Estate — 553 attacks
• Professional Services — 487 attacks
• Healthcare — Significant increase due to critical nature of operations
• Energy & Transportation — Critical infrastructure targets

Modern Ransomware Attack Stages – 2025

The ransomware attack lifecycle has evolved significantly. Modern threat actors operate with military-grade precision, following a structured "left-of-impact" timeline that security teams can hunt and disrupt. Understanding these phases is critical for implementing effective defensive measures.

Phase 0 – Target Acquisition

Before any technical attack begins, threat actors conduct extensive reconnaissance and target selection:

• AI-Driven Reconnaissance: Automated scanning tools rank potential targets by "pay-score" — analyzing company revenue, cyber insurance coverage, critical operations, and likelihood of payment based on public financial data and breach history.
• Access Acquisition: Purchase of compromised VPN credentials, Outlook Web Access (OWA) accounts, Citrix gateways, or zero-day exploits from Initial Access Brokers (IABs) on darknet markets.

Phase 1 – Initial Foothold

Establishing persistent presence in the target environment:

• Delivery Vectors: Phishing campaigns, SEO-poisoned fake software updates, USB drives delivered by mail, or direct exploitation of internet-facing vulnerabilities.
• Execution Techniques: Living-off-the-land binaries (LOLBAS), PowerShell obfuscation, legitimate system tools abused for malicious purposes. Implants are lightweight loaders to evade detection.
• Persistence Mechanisms: Scheduled tasks, Group Policy Objects (GPO), cloud automation runbooks, or WMI event subscriptions to survive reboots and maintain access.

Phase 2 – Internal Expansion

The median dwell time in 2025 is just 5 days from initial access to encryption deployment:

• Command & Control (C2): CDN-fronted HTTPS traffic, domain fronting through legitimate cloud services (Azure, CloudFlare), or edge computing resources to blend with normal traffic.
• Discovery Operations: Active Directory mapping, backup system inventory (critical for sabotage), cloud IAM reconnaissance, and identification of crown-jewel data repositories.
• Privilege Escalation: Kerberoasting attacks, Active Directory Certificate Services (ADCS) exploitation, token replay attacks, or zero-day privilege escalation exploits.
• Lateral Movement: RDP connections, PowerShell remoting (PS-Remoting), or weaponized Remote Management and Monitoring (RMM) tools like TeamViewer, AnyDesk, and ScreenConnect.

Phase 3 – Pre-Impact Preparation

Critical sabotage phase designed to ensure maximum damage and prevent recovery:

• Data Exfiltration: Using Rclone, Mega.nz, IPFS, or custom tools, attackers average 1.2 TB of sensitive data exfiltrated in under 3 hours. This data becomes leverage for double extortion.
• Defensive Sabotage: Attackers systematically dismantle recovery options by deleting Volume Shadow Copies (VSS), wiping VMware ESXi snapshots, and destroying backup catalogs. They also actively disable Endpoint Detection and Response (EDR) agents using "Bring Your Own Vulnerable Driver" (BYOVD) techniques to blind security teams before the final strike.

Phase 4 – Extortion

The final impact phase where ransom demands are issued:

• Rapid Encryption: Pre-staged encryption keys using ChaCha20 + RSA algorithms deployed across the network in under 60 seconds. Modern ransomware can encrypt 220,000 files in 4.5 minutes.
• Triple Extortion Model (29% of 2025 attacks): Beyond the traditional ransom for decryption keys, attackers now layer additional pressure by threatening to publish stolen data on leak sites (double extortion) and launching Distributed Denial-of-Service (DDoS) attacks against the victim's public infrastructure (triple extortion) to force payment.
• Aggressive Pressure Tactics: Live-stream countdown timers, spam to customers and partners, voice threats to executives using AI-cloned voices, direct contact with victims' clients threatening data exposure.
• Encryption-to-Note Delay: Average of 4 minutes between encryption completion and ransom note delivery, leaving minimal response window.

Critical Hunt Triggers for SOC Teams

Security Operations Centers should monitor for these high-fidelity indicators of ransomware activity:

• JA3 TLS Fingerprint Anomalies: SSL/TLS connections to newly-registered domains (less than 24 hours old), especially with uncommon cipher suites.
• Suspicious LDAP Queries: LDAP queries for adminCount=1 (privileged accounts) originating from non-administrative workstations — indicates reconnaissance for privilege escalation targets.
• Rclone.exe Execution: The legitimate cloud sync tool Rclone spawned by SYSTEM or running with suspicious command-line arguments — common data exfiltration tool.
• High-Entropy File Operations: File write operations with entropy greater than 0.96 (indicating encryption) affecting more than 100 network shares within 5 minutes — definitive ransomware encryption activity.
• VSS Deletion Commands: Execution of vssadmin delete shadows, wmic shadowcopy delete, or bcdedit /set {default} recoveryenabled no.
• RMM Tool Abuse: Unexpected installation or execution of AnyDesk, TeamViewer, ScreenConnect from System accounts or during off-hours.

Types of ransomware

Ransomware has evolved into several distinct categories, each with unique behaviors and extortion methods. Understanding these types is crucial for identifying the threat:

1. Crypto Ransomware (Encryptors)

Encryptors are the most prevalent and damaging variant in the modern threat landscape. This type infiltrates a system and encrypts valuable files (documents, photos, databases) using military-grade encryption algorithms (like AES-256 or RSA-2048). The content becomes completely inaccessible without the unique decryption key held by the attackers. Examples include LockBit, Ryuk, and WannaCry.

2. Lockers

Lockers do not encrypt specific files but instead completely lock you out of your operating system or user interface. A full-screen ransom note is displayed, often with a countdown timer to create urgency. While your files remain technically intact, they are inaccessible until the system is unlocked. This type was more common in early ransomware waves but still appears in mobile malware.

3. Scareware

Scareware is deceptive software that masquerades as a legitimate security tool. It claims to have detected non-existent viruses or critical issues on your computer and aggressively bombards you with pop-up alerts. It demands payment for a "full version" to fix these fake problems. Some aggressive scareware may lock the computer, while others simply annoy the user into paying.

4. Doxware or Leakware

Leakware (also known as Doxware) leverages the threat of data exposure rather than data loss. Attackers exfiltrate sensitive personal or corporate information and threaten to release it publicly or sell it on the dark web unless a ransom is paid. This tactic is particularly effective against businesses with strict compliance requirements (GDPR, HIPAA) or individuals with sensitive private data. A variation is police-themed ransomware, which impersonates law enforcement to accuse the victim of illegal activity and demands a "fine" to avoid arrest.

5. RaaS (Ransomware as a Service)

Ransomware as a Service (RaaS) is not a malware type but a business model that powers the modern ransomware economy. Professional core developers create the ransomware strain and payment infrastructure, then lease it to "affiliates" (lower-skilled hackers) who conduct the actual attacks. The profits are split, with affiliates typically keeping 70-80% and developers taking the rest. This model has led to the explosion of ransomware attacks by lowering the barrier to entry for cybercriminals.

Latest ransomware attacks

• Dire Wolf (.direwolf) Ransomware Virus - Removal and Decryption
• PE32 Ransomware
• VerdaCrypt Ransomware
• D0glun Ransomware: Analysis and Protection Guide
• Moscovium Ransomware
• Fox Ransomware
• Lucky Ransomware (MedusaLocker)
• CipherLocker Ransomware

Active Ransomware Families in 2025

The following ransomware groups remain highly active in 2025, responsible for the majority of attacks against organizations worldwide:

• LockBit 4.0 — Despite law enforcement disruptions in 2024, LockBit resurged with version 4.0, incorporating DDoS extortion tactics and faster encryption speeds. Remains one of the most prolific ransomware-as-a-service (RaaS) operations, responsible for numerous critical infrastructure attacks in 2025.
• Qilin (Agenda) — Highly sophisticated group targeting critical infrastructure including airports and healthcare. Responsible for the Kuala Lumpur Airport attack (March 2025, $10M demand) and Asahi Brewery disruption (November 2025). Uses Rust-based encryption and focuses on high-value enterprise targets.
• Rhysida — Active RaaS operation targeting healthcare, education, and government sectors. Notable 2025 attacks include Sunflower Medical Group (220,968 patient records) and Maryland Transit Administration (30 BTC/$3.4M ransom). Known for triple extortion and data leak site operations.
• Black Basta — Emerged from the Conti dissolution, employing AI-enhanced phishing campaigns using Large Language Models (LLMs) to craft convincing social engineering attacks. Focuses on enterprise targets with rapid deployment times and sophisticated infiltration methods.
• Akira — One of the most active groups in 2025, exploiting VPN vulnerabilities and targeting manufacturing, healthcare, and financial sectors. Uses double extortion tactics and maintains an active leak site. Known for targeting Cisco VPN and Citrix vulnerabilities.
• Medusa — Responsible for major 2025 attacks including NASCAR (SSN data leak, $4M ransom). Operates a RaaS model with affiliate partnerships. Notable for aggressive multi-stage extortion including direct contact with customers and partners of victims.
• Play — Targets critical infrastructure and large enterprises using intermittent encryption techniques to evade detection. Active throughout 2025 with attacks on government agencies and education institutions. Uses double extortion with dedicated leak site.
• Cl0p (Clop) — Specialist in supply chain and zero-day exploitation, particularly targeting file transfer applications and enterprise ERP systems. Responsible for Oracle E-Business Suite campaign affecting Cox Enterprises and Dartmouth College. Pioneered mass-exploitation tactics for maximum victim count.
• ALPHV/BlackCat — Rust-based ransomware known for flexibility and cross-platform capabilities (Windows, Linux, ESXi). Continues operations despite FBI disruption attempts. Uses triple extortion including calling victims' clients and partners. Notable for sophisticated affiliate program.
• Interlock — Responsible for DaVita Healthcare attack (April 2025, 2.7M patients, $13.5M losses). Targets healthcare and critical services with rapid encryption and comprehensive data exfiltration before encryption deployment.
• RansomHub — Fast-growing RaaS operation that attracted affiliates from shut-down operations. Known for rapid encryption and multi-platform support. Targets organizations across all sectors with emphasis on data exfiltration before encryption.
• Fog (Akira variant) — Uses exploited SonicWall VPNs for initial access. Targets education and healthcare sectors. Employs double extortion with dedicated leak infrastructure. Related to Akira operations but operates independently.
• Scattered Spider (0ktapus) — Sophisticated group using voice phishing with AI-generated deepfake voices to bypass MFA. Targets identity providers, telecommunications, and outsourcing companies. Known for social engineering expertise and "vishing" campaigns.
• 8Base — Extremely active throughout 2025 targeting small-to-medium businesses. Uses double extortion with dedicated leak site. Believed to have connections to REvil infrastructure. Focuses on rapid attacks against less-protected organizations.
• Cactus — Uses stolen VPN credentials and exploits Fortinet vulnerabilities for initial access. Targets manufacturing, financial services, and technology sectors. Employs sophisticated encryption with unique data exfiltration methods through SSH tunnels.

Defunct Operations: Conti (dissolved mid-2022), Avaddon (shutdown May 2021), Egregor (disrupted 2021), and Hive (seized by FBI 2023) are no longer active, though their techniques and members have migrated to newer operations listed above.

Read also: PE32 Ransomware

Is it a solution to pay the ransom?

The majority of income ransomware developers receive is used to fund various outlaw activities, such as terrorism, other malware distribution campaigns, drug dealership, and so on. Since all ransom payments are made in cryptocurrencies, there is no way to uncover the personality of crooks. However, email addresses can sometimes point out ransomware distributors in the Middle East.

As you can already conclude, paying the ransom equals participating in outlaw activities. Of course, no one will blame you for terrorism funding. But there is nothing pleasant to understand that money you get for fair work is spent on terrorism or drugs. Often even large corporations that are blackmailed with threats to publish some internal data are not paying a penny to those crooks.

How to protect from ransomware in 2025?

The evolving ransomware threat landscape demands a multi-layered defense strategy. Based on analysis of 2025 attacks, organizations and individuals should implement the following comprehensive protection measures:

Essential Security Controls

• Zero-Trust Architecture & Network Segmentation: Implement zero-trust security models that verify every access request regardless of source. Segment critical systems and data to limit lateral movement if attackers breach the perimeter.
• Multi-Factor Authentication (MFA) on All Remote Access: Require MFA for all VPN connections, Remote Desktop Protocol (RDP), and Remote Management and Monitoring (RMM) tools. This prevents credential-based attacks that account for 23% of ransomware incidents.
• Timely Patch Management: Prioritize patching of internet-facing systems including VPN appliances, enterprise ERP systems (Oracle E-Business Suite, SAP), and content management platforms. 32% of attacks exploit unpatched vulnerabilities.
• Quarterly Backup Testing: Conduct regular tests of backup restoration procedures in isolated environments. Ensure backups are stored offline or in immutable storage to prevent ransomware from encrypting them. Verify that recovery time objectives (RTO) meet business requirements.
• Endpoint Detection and Response (EDR): Deploy advanced EDR solutions capable of detecting Living-off-the-Land (LotL) techniques and BYOVD (Bring Your Own Vulnerable Driver) attacks that attempt to disable security controls.

Awareness Training for 2025 Threats

• AI-Generated Phishing Recognition: Train employees to identify sophisticated phishing attempts created by Large Language Models (LLMs). Emphasize verification of unexpected requests, even when emails appear professionally written and contextually relevant.
• Voice Call Verification Protocols: Establish procedures requiring employees to verify voice calls claiming to be from IT support through independent channels. AI voice cloning makes phone-based social engineering increasingly convincing.
• Macro and Attachment Caution: Continue reinforcing awareness about email attachments, particularly Microsoft Office files requesting macro enablement. Despite being a traditional vector, email remains a primary attack entry point (18% of incidents).

Advanced Protection Measures

• Disable Unnecessary RDP Exposure: Close external RDP ports and require VPN access before allowing remote desktop connections. Monitor and limit RDP usage to essential personnel only.
• Application Whitelisting: Implement application control policies that only allow approved software to execute, preventing unauthorized ransomware binaries from running.
• Email Security Gateways: Deploy advanced email filtering that can detect AI-generated phishing content and sandbox suspicious attachments before delivery to user inboxes.
• Incident Response Planning: Develop and regularly test incident response plans specifically for ransomware scenarios. Include procedures for isolating infected systems, activating backups, and engaging law enforcement and cybersecurity experts.

Anti-Malware Protection

Usually, anti-malware programs update their detection databases every day. GridinSoft Anti-Malware can offer you hourly updates, which decreases the chance that a completely new ransomware sample will infiltrate your system. However, making use of anti-malware software is not a panacea. It would be best if you were careful in all risky places. Those are:

• Email messages. Most ransomware cases, regardless of the family, are related to malicious email messages. People used to trust all messages sent through email and don't think something malicious may be inside the attached file. Meanwhile, cyber burglars use that weakness and bait people to enable macros in Microsoft Office files. Macros is a specific application that allows increasing the interaction with the document. You can construct anything on Visual Basic and add it to the document as macros. Crooks, without further thought, add ransomware code.
• Dubious utilities and untrustworthy programs. You may see various advice while browsing the Web. Online forums, social networks, and seeding networks - these places are known as sources for various specific tools. And there is nothing bad in such software - sometimes, people need the functions that are not demanded (or accepted) for corporate production. Such tools are so-called keygens for various apps, license key activators (KMS Activator is one of the most known), and utilities for system elements adjusting. Most anti-malware engines detect those applications as malicious, so you will likely disable the antivirus or add the app to the whitelist. Meanwhile, this utility may be clear or infected with trojans or ransomware.

Frequently Asked Questions

References

• Industrial Cyber / KELA: Global Ransomware Attacks Against Critical Industries Surge 34% in 2025 (October 22, 2025)
• Bright Defense (DeepStrike): Ransomware Statistics 2025 - Key Trends & Costs (October 6, 2025)
• Exabeam: Top Ransomware Statistics and Trends for 2025 (September 2025)
• NordLayer: 8 Biggest Ransomware Attacks of 2025 (October 2025)
• PKWARE: Data Breaches and Ransomware Attacks 2025 (November 2025)
• Commvault: Ransomware Trends 2026