Ransomware Attacks Surged in 2025 as Costs and Threat Actor Activity Grew
Summary
A 2025 ransomware year-in-review estimates attacks rose 40–50% year over year, with manufacturing and other critical sectors heavily targeted. It describes rising costs, double extortion, AI-assisted phishing, and expanding ransomware-as-a-service operations.
Key points
- Estimates put 2025 ransomware attacks at roughly 7,400 to more than 9,000, up around 40–50% from 2024.
- Manufacturing was the most frequently targeted industry; healthcare, energy, transportation, and financial services were also prominent targets.
- Global damages were estimated in the tens of billions of dollars, with some projections reaching $57 billion; average attack costs were estimated at about $5 million.
- Double extortion remained common, while some attackers relied on threats to expose stolen data without encrypting systems.
- The article describes AI-assisted phishing, greater automation, and ransomware-as-a-service as factors expanding the scale and accessibility of attacks.
- Qilin, Akira, RansomHub, and Clop were among the groups highlighted; the article says more than 100 groups operated during the year.
Article Details
- Publisher
- DarkOwl
- Report Period
- 2025
- Scope
- Global ransomware activity, victims, costs, targeting, tactics, and groups in 2025
- Key Statistics
- Estimates of global ransomware attacks ranged from roughly 7,400 to more than 9,000 in 2025, around 40–50% above the previous year.
- Some datasets publicly identified more than 7,000 organizations as ransomware victims; other incidents were unreported or undisclosed.
- Roughly half of recorded attacks targeted critical industries.
- The United States accounted for roughly half of recorded attacks.
- Estimated global damages reached tens of billions of dollars, with some projections as high as $57 billion; the average attack cost was around $5 million.
- Recommendations
- Strengthen technical controls and resilience in critical systems.
- Develop a deeper understanding of the ransomware threat ecosystem and adapt defenses as adversary methods evolve.
- Monitor ransomware leak sites for potential impacts to organizations in the supply chain.
MITRE ATT&CK
Threat Actors
AkiraProminent ransomware group described as targeting enterprises and critical infrastructure.ClopRansomware group described as conducting large-scale campaigns, often exploiting software vulnerabilities.QilinRansomware-as-a-service operation described as one of the fastest-growing in 2025.RansomHubRansomware group reportedly linked to hundreds of victims across multiple sectors.
Countries
Industries
EnergyRoughly half of all attacks targeted sectors that underpin modern economies, including manufacturing, healthcare, energy, transportation, and financial services.Financial ServicesRoughly half of all attacks targeted sectors that underpin modern economies, including manufacturing, healthcare, energy, transportation, and financial services.HealthcareRoughly half of all attacks targeted sectors that underpin modern economies, including manufacturing, healthcare, energy, transportation, and financial services.ManufacturingRoughly half of all attacks targeted sectors that underpin modern economies, including manufacturing, healthcare, energy, transportation, and financial services.TransportationRoughly half of all attacks targeted sectors that underpin modern economies, including manufacturing, healthcare, energy, transportation, and financial services.