Bitsight 2026 Report Finds Rising Ransomware Claims Despite Declines in Observed Breaches
Original report publisher: not verified. Report discovered via Awesome Annual Security Reports.
Summary
Bitsight’s 2026 underground report records 6,883 ransomware attack postings in 2025, up 19%, and 2.8 billion newly observed compromised credential sets. It cautions that falling breach and stealer-log counts do not necessarily indicate lower risk.
Key points
- The report aggregates 2025 intelligence from underground communities, marketplaces, malware and endpoint telemetry, vulnerability tracking and public incident reporting.
- Ransomware groups posted 6,883 unique attacks, up 19% year over year; active leak sites increased from 86 to 115. Total ransom payments reportedly fell 66%.
- Observed breaches fell from 5,865 to 3,447. Bitsight cautions that reporting gaps, visibility changes and shifting attacker behavior may contribute to the decline.
- Bitsight collected 2.8 billion newly observed unique username-password combinations, down 22% from 2024. Previously observed combinations are not counted again, and expanded collection affects historical comparisons.
- Exposed AI-related services increased 360% to more than one million instances. Underground AI discussions were widespread, but Bitsight could not confirm how the tools were used in every case.
- Visible endpoint logs fell from 7.85 million to 3.95 million; Lumma remained the leading stealer family despite infrastructure disruption and lower observed volume.
- Bitsight observed nearly 34 million vulnerable IPs, up 45%, and recommends prioritizing relevant exposures, strengthening identity controls and monitoring third-party risk.
Article Details
- Publisher
- Bitsight
- Report Period
- 2025-01-01 to 2025-12-31
- Scope
- Global underground activity, ransomware leak sites, breaches, malware, endpoint logs, compromised credentials, payment cards, and vulnerability exposure; includes multi-year comparisons and selected 2026 examples.
- Key Statistics
- Ransomware groups posted 6,883 unique attacks in 2025, up 19% from 2024; these are posted claims, not independently confirmed incidents. Active data leak sites increased from 86 to 115.
- Observed breach incidents decreased from 5,865 in 2024 to 3,447 in 2025, approximately 41%; the report cautions that visibility changes, reporting gaps, and monetization shifts may contribute.
- Bitsight collected 2.8 billion newly observed unique compromised credential sets in 2025, down 22% from 2024. Previously observed combinations are not counted again, and expanded collection beginning in 2023 affects multi-year comparisons.
- Bitsight observed nearly 34 million unique vulnerable IPs and more than 166,000 unique vulnerable entities in 2025, increases of 45% and 27%, respectively, over 2024.
- Exposed AI-related services increased 360% in 2025, exceeding one million exposed instances.
- Recommendations
- Prioritize vulnerability remediation using exposure, exploitability, relevant threat actor activity, and industry context rather than severity alone.
- Assess supplier and vendor relationships for inherited vulnerability exposure and cascading operational risk.
- Strengthen authentication, monitor credential abuse, and improve identity-layer resilience.
- Accelerate remediation of relevant critical vulnerabilities rather than relying solely on scheduled patching.
MITRE ATT&CK
T1047 · Windows Management InstrumentationINC Ransom uses WMIC for lateral movement and administrative activity.T1078 · Valid AccountsAkira uses compromised credentials, while INC Ransom uses purchased credentials to obtain access.T1090.002 · External ProxyThreat actors use residential proxy services to avoid detection and make their traffic appear to originate from legitimate users.T1190 · Exploit Public-Facing ApplicationAkira and INC Ransom exploit internet-facing systems; Cl0p exploits enterprise software, particularly managed file transfer platforms.T1486 · Data Encrypted for ImpactThe ransomware profiles describe encryption used by Qilin, Akira, Play, and INC Ransom to disrupt operations and pressure victims.T1555.003 · Credentials from Web BrowsersThe malware section describes stealers targeting browser credentials, and the endpoint analysis identifies browser credential exposure following infection.T1566 · PhishingINC Ransom uses spearphishing, and multiple state-linked profiles describe phishing-driven intrusions.
People
Threat Actors
AkiraThe report attributes 670 attacks in 2025 to Akira and describes exploitation of exposed systems, compromised credentials, and double extortion.Cl0pThe report attributes 478 attacks in 2025 to Cl0p and describes broad data-theft extortion operations exploiting enterprise software vulnerabilities.Flax TyphoonProfiled as associated in reporting with China-linked espionage; Bitsight TI links it to Integrity Technology Group, Inc. and describes persistent access through public-facing systems and trusted components.INC RansomThe report attributes 345 attacks in 2025 to INC Ransom and describes exploitation, spearphishing, purchased credentials, and high-pressure extortion.LockBitThe report states that LockBit has undergone five major iterations, illustrating ransomware operators' ability to rebuild after disruption.NoName057(16)Reportedly increased targeting of US and UK critical infrastructure and key resources, seemingly in connection with Russia-Ukraine tensions.PlayThe report attributes 365 attacks in 2025 to Play, which targets operationally sensitive organizations using encryption and disruption.QilinThe report identifies Qilin as the most active ransomware group in its 2025 dataset, reporting 911 attacks and describing an affiliate-led ransomware-as-a-service operation using double extortion.Salt TyphoonProfiled as an espionage actor targeting telecommunications, ISPs, government, and technology; reporting links it to Sichuan Juxinhe Network Technology Co., LTD.Volt TyphoonProfiled as associated in reporting with China-linked espionage, pursuing long-term access and strategic positioning in critical infrastructure.
Malware
Acreedfamilies including Wirex (441.2k), Robinhood (196.2k), Katana (164.4k), Lumma (106.5k), Vidar (104.2k), Acreed (95.8k), Rhamadanthys (72.1k), Gorilla (51.3k), Whisper (35.2k), Cleanup (27.5k / 31.2k), MVP (25.7k),BeaverTailThe group, closely linked to Famous Chollima, targeted Web3 developers using malware including BeaverTail, OtterCookie, and InvisibleFerret alongside AI-enabled tools such as Cursor and ChatGPT, creating a visibleInvisibleFerretto Famous Chollima, targeted Web3 developers using malware including BeaverTail, OtterCookie, and InvisibleFerret alongside AI-enabled tools such as Cursor and ChatGPT, creating a visible example of how threatLumma StealerChatGPT discussions aligned most frequently with Katana, Lumma, and Lumma Stealer.OtterCookiegroup, closely linked to Famous Chollima, targeted Web3 developers using malware including BeaverTail, OtterCookie, and InvisibleFerret alongside AI-enabled tools such as Cursor and ChatGPT, creating a visible exampleRedLineTop stealers seen for compromising endpoints: Malware family activity comparison (2024 vs 2025) across Lumma, RisePro, Vidar, StealC, Redline, Raccoon, Taurus, Rhadamanthys, and Acreed.]RhadamanthysTop stealers seen for compromising endpoints: Malware family activity comparison (2024 vs 2025) across Lumma, RisePro, Vidar, StealC, Redline, Raccoon, Taurus, Rhadamanthys, and Acreed.]RiseProTop stealers seen for compromising endpoints: Malware family activity comparison (2024 vs 2025) across Lumma, RisePro, Vidar, StealC, Redline, Raccoon, Taurus, Rhadamanthys, and Acreed.]StealCTop stealers seen for compromising endpoints: Malware family activity comparison (2024 vs 2025) across Lumma, RisePro, Vidar, StealC, Redline, Raccoon, Taurus, Rhadamanthys, and Acreed.]Vidarwith malware families including Wirex (441.2k), Robinhood (196.2k), Katana (164.4k), Lumma (106.5k), Vidar (104.2k), Acreed (95.8k), Rhamadanthys (72.1k), Gorilla (51.3k), Whisper (35.2k), Cleanup (27.5k / 31.2k),
Products
AnyDesksystems, especially VPN appliances and backup solutions, plus compromised credentials; tools such as AnyDesk and LogMeIn; evolving payloads including Rust-based variantsChatGPTdiscussion of AI tools, including roughly 5 million mentions of Gemini, 1.4 million mentions of ChatGPT, 656,000 mentions of Claude, and 697,000 mentions of Grok.Claudeincluding roughly 5 million mentions of Gemini, 1.4 million mentions of ChatGPT, 656,000 mentions of Claude, and 697,000 mentions of Grok.Cursorusing malware including BeaverTail, OtterCookie, and InvisibleFerret alongside AI-enabled tools such as Cursor and ChatGPT, creating a visible example of how threat actors are integrating AI into active operations.Geminiobserved significant underground discussion of AI tools, including roughly 5 million mentions of Gemini, 1.4 million mentions of ChatGPT, 656,000 mentions of Claude, and 697,000 mentions of Grok.Grokmentions of Gemini, 1.4 million mentions of ChatGPT, 656,000 mentions of Claude, and 697,000 mentions of Grok.LogMeInespecially VPN appliances and backup solutions, plus compromised credentials; tools such as AnyDesk and LogMeIn; evolving payloads including Rust-based variantsVMware ESXi- **Common Access or Tradecraft**: Affiliate-led intrusions, Windows and Linux targeting, including VMware ESXi; AES and RSA encryption
Tools
AdFind- **Common Access or Tradecraft**: Proven post-compromise techniques, including tools like AdFind for Active Directory reconnaissance; some reported infrastructure overlap with other ransomware ecosystemsCobalt Strikevulnerabilities, especially managed file transfer platforms; tools and techniques include Mimikatz, Cobalt Strike, and custom exfiltration toolingCovenant| **Associated Tooling** | GooseEgg, Covenant, BEARDSHELL, SLIMAGENT, EdgeOS router infrastructure |JuicyPotato| **Associated Tooling** | BlackKingdom, JuicyPotato, Nosedive, Mimikatz, Godzilla web shell, ArcGIS web shell modification |Mimikatzsoftware vulnerabilities, especially managed file transfer platforms; tools and techniques include Mimikatz, Cobalt Strike, and custom exfiltration toolingnetscan- **Common Access or Tradecraft**: Exploitation of internet-facing systems, spearphishing, and purchased credentials; use of WMIC, PsExec, and Netscan for lateral movement and low-noise administrationPsExec- **Common Access or Tradecraft**: Exploitation of internet-facing systems, spearphishing, and purchased credentials; use of WMIC, PsExec, and Netscan for lateral movement and low-noise administrationwmic- **Common Access or Tradecraft**: Exploitation of internet-facing systems, spearphishing, and purchased credentials; use of WMIC, PsExec, and Netscan for lateral movement and low-noise administration
Countries
ChinaWhile many countries experienced a drop in endpoint log targeting, the United States and China saw notable increases, rising 46% and 181%, respectively.IndiaActivity clustered around Russia, Israel, India, and the United States, driven by the Russia-Ukraine war, Middle East conflicts, and Israel-Palestine dynamics, with targeting extending to countries perceived asIndonesiadeclined, but risk did not disappear.** Breach incidents fell from 5,865 in 2024 to 3,447 in 2025. Indonesia became the most represented country in 2025 with 484 incidents, followed by the United States at 407.Iran| **Reported Affiliation** | Linked in reporting to Iran’s Ministry of Intelligence and Security (MOIS) |IsraelActivity clustered around Russia, Israel, India, and the United States, driven by the Russia-Ukraine war, Middle East conflicts, and Israel-Palestine dynamics, with targeting extending to countries perceived asNorth Korea- [North Korea](#north-korea)RussiaAll of the top 5 threat groups were either Russia-linked or Russian speaking.UkraineGroups like NoName057(16) increased their targeting specifically on US and UK critical infrastructure and key resources, seemingly driven by tensions stemming from the conflict in Russia and Ukraine.United Kingdom![Figure 5: Number of ransomware victims identified per country in 2025, with the United States leading, followed by Unidentified, Canada, United Kingdom, Germany, Italy, France, Brazil, and Australia.]United Statesin 2025. Indonesia became the most represented country in 2025 with 484 incidents, followed by the United States at 407.
Industries
business servicesManufacturing remained the most targeted sector for ransomware attacks, followed by business services and engineering.EducationIn 2025, Education led with 505 incidents, followed by Government/Politics at 475 and Technology at 469.EngineeringManufacturing remained the most targeted sector for ransomware attacks, followed by business services and engineering.finance| Finance | +32.358% |Government/PoliticsIn 2025, Education led with 505 incidents, followed by Government/Politics at 475 and Technology at 469.Healthcare/Wellness| Healthcare/Wellness | -34.619% |ManufacturingManufacturing remained the most targeted sector for ransomware attacks, followed by business services and engineering.TechnologyIn 2024, Technology led with 1,210 incidents.Telecommunications| Telecommunications | +21.900% |Utilities| Utilities | +32.534% |