Ransomware trends in 2025 point in one direction: attacks are more frequent, more fragmented across smaller groups, and increasingly aimed at industries that were once considered lower-risk, from manufacturing to local government. Verizon’s 2025 Data Breach Investigations Report found ransomware present in 44% of confirmed breaches, a 37% jump year-over-year, and for small and midsize businesses that share climbs even higher. The old picture of a handful of dominant gangs has also broken down; law enforcement takedowns have splintered the ransomware-as-a-service ecosystem into dozens of newer, smaller operators competing for the same victims. This guide breaks down what’s actually changed in 2025: the numbers behind the surge, which groups are driving it, the tactics they’re using to get past modern defenses, and what that means for how organizations should be prioritizing protection right now.
What Is Ransomware? (Quick Refresher)
Ransomware is malicious software that blocks access to a victim’s systems or data, usually by encrypting files, until a ransom is paid; in 2025, that basic definition has expanded to include a second layer of pressure: threatening to leak stolen data even if the victim can recover from backups. That “double extortion” model is now the default rather than the exception, which is part of why ransomware has become harder to neutralize with backups alone.
How Ransomware Attacks Work
A typical ransomware attack moves through a predictable sequence: attackers gain an initial foothold through phishing, a compromised credential, or an unpatched internet-facing system; they move laterally across the network to identify valuable data and critical infrastructure; they exfiltrate sensitive files before deploying the encryption payload; and only then do they lock systems and issue a ransom demand, often with a countdown tied to a data-leak threat. The gap between initial access and encryption has narrowed considerably, giving defenders a shrinking window to detect and contain an intrusion before it turns into a full-blown incident.
Ransomware-as-a-Service Explained
Ransomware-as-a-Service (RaaS) is a criminal business model where developers build and maintain the ransomware itself, then lease it out to “affiliates” who carry out the actual attacks in exchange for a cut of the ransom. This division of labor is the single biggest reason ransomware has scaled the way it has: it removes the need for a single attacker to have great technical skill, letting far more people participate for a share of the payout. By 2025, RaaS was no longer a niche approach; it’s estimated to be behind roughly 72% of ransomware incidents, effectively industrializing what used to be a specialist crime.
Ransomware by the Numbers, 2025 Statistics
Ransomware statistics in 2025 tell a story of rising attack volume paired with falling profitability: more organizations are getting hit, but fewer are paying, and the ones that do pay are handing over noticeably smaller amounts than a year ago.
Sophos, Coveware & Chainalysis: What the Major Reports Say
The three most-cited ransomware trackers each measure a slightly different slice of the problem, but they point the same direction. Sophos’s State of Ransomware research, based on a survey of thousands of organizations, has tracked average recovery costs falling as backup and incident-response maturity improves. Coveware, which handles ransomware negotiations directly, reported that only 23% of victims paid a ransom in Q3 2025, the lowest rate the firm has ever recorded, and part of a payment-rate decline that’s now stretched across six consecutive years. Chainalysis, which tracks cryptocurrency flows to known ransomware wallets, has found that while total ransom revenue has cooled, the median amount extracted per payment has climbed sharply, as attackers increasingly concentrate effort on fewer, higher-value targets rather than casting a wide net for small payouts.
Verizon DBIR: Ransomware’s Share of Breaches
Verizon’s 2025 Data Breach Investigations Report found ransomware present in 44% of all confirmed breaches, up from 32% the year before, a 37% year-over-year jump. The effect isn’t evenly distributed: at large organizations, ransomware factored into 39% of breaches, but at small and midsize businesses that figure jumped to 88%, underscoring that smaller companies remain disproportionately exposed compared to enterprises with more mature defenses.
Average Ransom Payment & Demand Trends
Payment amounts and payment rates are moving in opposite directions. Coveware’s Q3 2025 data put the average ransom payment at roughly $377,000, a 66% drop from the prior quarter, with the median payment falling 65% to $140,000, driven largely by large enterprises refusing to pay and mid-market victims settling for smaller sums. At the same time, broader market data suggests demands themselves haven’t softened at the same pace: attackers are compensating for fewer payouts by pushing harder for bigger ransoms from the victims who do end up paying, rather than accepting shrinking margins across the board.
The Most Active Ransomware Groups in 2025
A handful of dominant brands no longer defines the ransomware landscape in 2025; it’s defined by fragmentation, with law enforcement takedowns scattering affiliates across a growing pool of smaller, faster-moving operations. Researchers tracked 124 distinct named ransomware groups active in 2025, a 46% jump from the year before and the highest number ever recorded in a single year.
Akira, Qilin’s Allies & the New Cartel Model
Akira and Qilin have consistently ranked among the most active operators through 2025, and Coveware’s data shows both increasingly favoring a high-volume, low-demand strategy, hitting smaller organizations with modest ransom amounts rather than chasing a few large payouts. (For a deeper look at Qilin’s tactics and history, see our dedicated Qilin ransomware breakdown.) What’s more notable in 2025 is how groups are cooperating rather than just competing: DragonForce rebranded itself as a “ransomware cartel” in March, letting affiliates build and operate their own branded variants on shared DragonForce infrastructure, and by September the group had publicly floated a coalition involving LockBit and Qilin, signaling that established brands are increasingly willing to share affiliates, tooling, and even victims rather than operate in strict silos.
Medusa, Cl0p, Black Basta & Other Rising Threats
Alongside the cartel-style operators, several other groups have carved out significant footholds in 2025. Cl0p made headlines for exploiting zero-day vulnerabilities in enterprise file-transfer and database software at scale, favoring data-theft extortion over encryption. Medusa and Black Basta have continued targeting healthcare and critical infrastructure with double-extortion tactics. At the same time, newer entrants like Blacklock and Interlock have expanded their reach across Windows, Linux, and virtualization platforms such as VMware ESXi, broadening the pool of systems any single organization needs to defend.
New and Emerging Strains to Watch
The churn beneath the top-tier groups has been just as significant as the activity at the top. Strains like Lynx, SafeLocker, and KillSec have all surfaced or gained traction in 2025, often built by the same small set of underground developers cycling through rebrands; one operator behind the Blacklock and Eldorado strains, for instance, later launched Mamona, which was quickly rebranded again as Global ransomware. That constant renaming makes attribution difficult, but it also means defenders shouldn’t assume a quiet group has gone away; it may simply be operating under a new name.
Evolving Attack Techniques
Ransomware groups spent much of 2025 focused less on building more powerful encryption and more on evading the security tools meant to catch them before encryption ever starts. The tactics below represent some of the most significant shifts defenders have had to account for this year.
EDR Evasion (EDRKillShifter, EDR-Freeze)
EDR evasion tools like EDRKillShifter and the technique known as EDR-Freeze aim to blind endpoint detection and response software without triggering the alerts that a straightforward uninstall or termination would cause. EDR-Freeze, disclosed by a security researcher in September 2025, abuses a legitimate Windows diagnostic component to put security agents into a suspended “coma” state; the software still appears to be running, but it stops actually monitoring anything, giving attackers an undetected window to deploy tools like credential dumpers or ransomware payloads. What makes this class of technique notable is that it works entirely through legitimate, signed Windows components rather than a vulnerable driver, making it harder for defenders to flag as inherently malicious.
Windows Restart Manager Abuse
Several ransomware families, including Akira, have continued abusing the Windows Restart Manager, a legitimate feature originally built to gracefully close applications holding files open during software updates, to force-close programs like databases and backup agents that would otherwise block a file from being encrypted. Because the Restart Manager is a standard, signed Windows component rather than custom malware, this behavior can slip past defenses tuned to catch obviously malicious activity, and it’s part of why modern ransomware can encrypt an entire environment so quickly once it reaches that stage.
Initial Access & C2 Infrastructure Trends
Most ransomware attacks still begin the same few ways: compromised credentials, exposed remote access services, and unpatched software. Compromised remote access tools, particularly exposed RDP and VPN endpoints, were involved in roughly 28% of ransomware attacks in 2025, and credentials sourced from dark web marketplaces contributed to another meaningful share of initial access cases. Akira, in particular, has been repeatedly linked to attacks exploiting a VPN multi-factor authentication bypass on SonicWall devices, underscoring how a single vendor vulnerability can become a reliable entry point across dozens of separate victim organizations before it’s fully patched.
Now writing the section with these findings.
Industry Impact: Who’s Being Hit Hardest
Ransomware attackers in 2025 didn’t spread themselves evenly across industries; critical services with low tolerance for downtime, from hospitals to school districts to power and manufacturing operators, remained disproportionately attractive targets because disruption itself creates leverage to extract a ransom.
Healthcare & Hospitals
Healthcare stayed one of the most heavily targeted sectors in 2025, with ransomware gangs claiming credit for hundreds of attacks on hospitals, clinics, and other direct-care providers over the year. What shifted was the pressure point: attacks on healthcare-adjacent businesses, like billing services and medical technology vendors, actually rose faster than attacks on hospitals themselves, since compromising one vendor can expose the patient data of dozens of downstream provider organizations at once. Qilin, INC Ransom, and SafePay were among the most active groups claiming healthcare victims through the year, and average ransom demands against providers hovered in the mid-six-figure range even as payment rates fell industry-wide.
Critical Infrastructure & Energy
Critical infrastructure operators faced a particularly aggressive threat from Akira, which CISA and the FBI flagged in a November 2025 joint advisory as an imminent risk to manufacturing, energy, healthcare, and financial services organizations. The advisory noted that Akira had expanded beyond its original Windows and VMware ESXi targets to begin encrypting Nutanix virtualization platforms for the first time, and that the group had accumulated roughly $244 million in ransom proceeds since first appearing in 2023, a scale that reflects how a single group can sustain years-long, cross-sector campaigns against infrastructure operators that can’t easily tolerate extended downtime.
Education
Education held relatively steady in attack volume in 2025 compared with 2024. Still, the scale of data exposure jumped sharply, driven largely by third-party software vulnerabilities rather than direct attacks on individual schools. Several of the year’s largest education breaches traced back to a single vendor-side vulnerability, underscoring that a school district’s ransomware risk increasingly depends on the security of the software vendors and IT providers it relies on, not just its own network defenses. On a more encouraging note, Sophos found that average recovery costs in education dropped substantially in 2025, suggesting institutions that had invested in incident-response planning were bouncing back faster and cheaper than in prior years.
The Real Cost of Ransomware in 2025
The cost of a ransomware attack in 2025 goes well beyond the ransom itself, and the two most important numbers to understand are recovery cost and how long it takes to notice an attacker is even inside the network. Total incident costs, including downtime, remediation, and reputational fallout, averaged around $5 million per incident in 2025. However, the direction of that trend is finally starting to bend the right way for defenders.
Average Payments, Dwell Time & Recovery Costs
Recovery costs actually fell meaningfully in 2025 compared with the year before: Sophos found average recovery expenses excluding the ransom itself dropped by roughly 44%, driven largely by faster detection and more organizations having tested recovery plans in place before an attack ever happens. That’s a notable shift from previous years, where slow detection and improvised recovery drove costs far higher than the ransom demand itself. At the same time, dwell time, how long attackers sit inside a network before being discovered, remains the single biggest cost multiplier: the longer that window stays open, the more time attackers have to locate backups, exfiltrate sensitive data, and identify which systems will cause the most damage if encrypted, all of which directly inflates the eventual recovery bill.
Regulatory Fallout (HHS/HIPAA Settlements)
Regulators kept up steady pressure on healthcare organizations that suffer ransomware breaches without adequate safeguards in place. Throughout 2025, HHS’s Office for Civil Rights continued its Risk Analysis Initiative, reaching a string of HIPAA settlements tied directly to ransomware incidents where organizations were found to have never conducted a proper security risk analysis before the attack. These settlements have consistently centered on the same root failure: the absence of a documented, up-to-date risk analysis, making clear that regulators view a missing risk assessment as an aggravating factor once a ransomware breach exposes protected health information, regardless of the breach’s size.
How Organizations Are Defending Against Ransomware
Ransomware defense in 2025 has shifted from a purely reactive posture, clean up after an attack, toward earlier detection, tested recovery plans, and insurance underwriting that actually verifies security controls instead of taking a self-reported questionnaire at face value.
Threat Intelligence & Early Warning
Because most ransomware attacks begin with a compromised credential, an exposed remote-access service, or an exploited vulnerability, early warning has become one of the highest-leverage places to intervene, often catching an intrusion during the access or reconnaissance stage, well before encryption ever starts. Threat intelligence that surveils dark web marketplaces, ransomware leak sites, and criminal forums can flag when an organization’s credentials, VPN access, or internal data are already being traded or discussed by affiliates, giving defenders a chance to rotate credentials and patch exposed systems before an attack escalates to full encryption. That earlier-detection shift is showing measurable results: Sophos found that 53% of organizations fully recovered from a ransomware attack within one week in 2025, up from just 35% the year before.
Backup & Recovery Best Practices
Offline, immutable backups remain the single most reliable safeguard against ransomware, but 2025’s attack techniques have made “having backups” insufficient on its own; many ransomware families now specifically hunt for and disable backup agents before encrypting the rest of the environment. Effective recovery in 2025 depends on backups that are both segmented from the production network and regularly tested through actual restoration drills, not just scheduled and forgotten, since an untested backup that fails during a real incident provides no more protection than having no backup at all.
Cyber Insurance Considerations
Cyber insurance pricing broadly stabilized through 2025 after several years of steep premium increases. Still, underwriting scrutiny tightened in the opposite direction: insurers now routinely verify specific controls, multi-factor authentication, endpoint detection, offline backups, and a documented incident-response plan before binding a policy, and organizations that can’t demonstrate those controls face exclusions, higher deductibles, or denied claims rather than automatic coverage. Ransomware-specific sublimits and war exclusions have also drawn more attention, meaning organizations should read the fine print on what counts as a “ransomware event” under their policy rather than assuming a general cyber policy fully covers an extortion-driven attack.
Frequently Asked Questions (FAQ’s)
Is ransomware still increasing in 2025 and 2026?
Yes, despite payment rates falling to historic lows, attack volume kept climbing through 2025, with independent trackers recording anywhere from a 32% to 58% year-over-year increase in ransomware attacks depending on the dataset and methodology used. The consistent theme across every major tracker is growth in the number of attacks and the number of active groups, even as the economics of getting paid have gotten tougher for attackers.
Which ransomware group is most active right now?
Akira and Qilin have consistently ranked among the most active operators through 2025, with both increasingly favoring high-volume attacks on smaller organizations over a handful of large-ransom targets. That said, “most active” shifts quarter to quarter as law enforcement takedowns disrupt individual groups and affiliates migrate to newer or rebranded operations, so any single answer has a short shelf life.
How much does the average ransomware attack cost?
Total incident costs, including downtime, remediation, and reputational impact, averaged around $5 million per incident in 2025, though the ransom payment itself is typically a small fraction of that figure. Recovery costs excluding the ransom have actually been trending down as more organizations invest in tested backup and incident-response plans ahead of time.
Should a company ever pay the ransom?
Most guidance from law enforcement and cybersecurity practitioners advises against paying, and the data increasingly backs that up: 64% of ransomware victims refused to pay in 2025, up sharply from just 50% two years earlier. Paying doesn’t guarantee stolen data won’t be leaked anyway, and organizations that refuse to pay are increasingly finding they can still recover fully within days if their backups and response plans are solid.
What’s the single biggest thing organizations can do to reduce ransomware risk?
Shrinking the time between initial compromise and detection matters more than almost anything else, since nearly every stage of a ransomware attack, from credential theft to data exfiltration to encryption, depends on attackers having uninterrupted access for days or weeks. Combining early-warning threat intelligence with tested, offline backups addresses both ends of that timeline: catching intrusions before they escalate, and ensuring a fast recovery if one slips through.
