Security Report · raw.githubusercontent.com

GuidePoint Report Finds Ransomware Victim Claims Rose 58% in 2025

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

GuidePoint’s GRIT tracked 7,515 publicly posted ransomware and extortion victims in 2025, up 58%, across 124 groups. Its annual report examines perimeter exploitation, payment outcomes and growing BYOVD adoption; victim claims were not validated by victims.

Key points

GRIT recorded 7,515 publicly posted victims across 124 named groups in 2025. Its dataset includes extortion-only operations, screens claims for credibility and duplication, and does not establish victim-confirmed incidents or total attack volume.
Qilin led public victim claims with 1,044 postings, up from 154 in 2024. GRIT assesses that affiliates migrating after RansomHub’s shutdown likely contributed to its growth.
Manufacturing accounted for 1,060 observed victims, or 14% of the annual total. Legal-sector postings rose 132% to 455, while the United States represented more than 55% of all observed victims.
Exploitation of internet-facing enterprise software and perimeter devices remained important: the report links Akira to SonicWall exploitation, Qilin to SAP and Fortinet flaws, and Clop to Oracle E-Business Suite data theft.
Using TRM Labs-tagged wallets, GRIT assessed at least 160 Akira transactions and 128 Qilin transactions as ransom payments, totaling at least $73 million and $47 million respectively. Its internal negotiation data carries acknowledged selection bias.
Bring Your Own Vulnerable Driver capabilities increasingly became commodity tools for disabling endpoint defenses. GRIT also observed widespread abuse of legitimate remote-management tools and living-off-the-land techniques.
GRIT found AI use concentrated on negotiations, social engineering and stolen-data analysis, rather than fully autonomous ransomware campaigns at scale. It recommends prioritizing perimeter security, access controls, data-theft prevention and validated immutable backups.

Article Details

Publisher: GuidePoint Research and Intelligence Team (GRIT)
Report Period: 2025-01-01 to 2025-12-31
Scope: Global financially motivated ransomware and data extortion, vulnerability exploitation, payment outcomes, and law enforcement disruption.
Sample Size: 7,515 publicly posted alleged victims across 124 named groups in the annual dataset; claims were screened by GRIT but not validated by alleged victims. Payment analyses use separate datasets.
Key Statistics: GRIT recorded 7,515 publicly posted alleged ransomware victims in 2025, a reported 58% year-over-year increase; undisclosed attacks and potential claim inflation limit interpretation.
The annual dataset tracked 124 distinct named groups in 2025, compared with 88 in 2024; the vulnerability-analysis section separately reports 117 groups.
The United States accounted for 4,161 publicly posted alleged victims, or 55.37% of the annual dataset.
Publicly posted legal-sector victims increased from 196 in 2024 to 455 in 2025, a reported 132% increase; 335 of the 2025 victims were in the United States.
Using tagged cryptocurrency wallets, GRIT assessed at least 160 Akira transactions totaling $73 million and at least 128 Qilin payments totaling $47 million as ransomware payments during 2025; these are observed minimums rather than complete revenue totals.
Recommendations: Use network segmentation, least-privilege or zero-trust architectures, and attack surface reduction to complicate or prevent data theft.
Deploy and validate immutable backups segmented from the main IT network.
Use American Bar Association, CISA, and FBI resources to develop and validate legal-sector cybersecurity practices.
Prioritize rapid detection and response and comprehensive identity and access controls.
Treat critical zero-day vulnerabilities as potential ransomware entry points regardless of their initial threat attribution.