Ransomware activity escalated sharply in the final quarter of 2025, setting a troubling pace as the cybersecurity landscape heads into 2026. According to Cyble’s Q4 2025 ransomware report, threat actors claimed more than 2,000 ransomware attacks between October and December, marking an increase of over 30 % compared to the earlier months of 2025.
This surge reflects not only the frequency of attacks but also the widening diversity of active ransomware groups, their evolving tactics, and the increasingly strategic targeting of high-value industries.
Ransomware Tactics and Trends
Increased Volume and Persistence
During the last four months of 2025, ransomware groups averaged nearly 700 claimed victims per month, compared with an average of 512 monthly victims earlier in the year. Organizations across sectors experienced heightened exposure, revealing that cybercriminal operations have not slowed—despite intensified defensive efforts.
Double-Extortion and Supply Chain Impacts
Ransomware operations continued to refine their playbooks. After encrypting critical systems, many attackers employed double-extortion tactics, threatening to leak stolen data publicly to coerce payment. Supply chain attacks—wherein software vendors or third-party services are compromised to reach multiple victims—also played a larger role in 2025, with hundreds of such incidents linked directly or indirectly to ransomware actors.
Industry analyses show ransomware and software supply chain attacks have increasingly intertwined, with adversaries exploiting interconnected cloud services, vendor accounts, and trusted third-party relationships to maximize downstream impact.
Profiles of Leading Ransomware Groups
Several ransomware groups stood out in Q4 2025, both in volume and operational reach:
Qilin
Qilin remained one of the most active groups, leading all ransomware actors with the highest number of claimed victims, including in early 2026. Its campaigns spanned multiple regions and industry verticals, demonstrating persistent operational momentum.
(A separate analysis of Qilin shows it has been linked to high-impact incidents and is considered a sophisticated, adaptable adversary in the broader cybercrime ecosystem.)
CL0P
After a period of relative dormancy, CL0P re-emerged late in 2025 with a wave of attacks, including exploitation of a widely reported enterprise application vulnerability. Although detailed technical reports were limited at the time of publication, CL0P’s return was a key factor in elevated attack volumes.
Akira
Continuing its rise through 2025, Akira remained among the top ransomware threats, contributing a substantial number of claimed victims. Analysts have also identified Akira as a serious risk to critical infrastructure and industrial targets.
Emerging Actors
Newer groups such as Sinobi and The Gentlemen also featured among the most active adversaries in Q4, indicating that the ransomware ecosystem continues to grow in complexity and membership rather than consolidating around a few core actors.
Geographic and Sectoral Patterns
Geographic Distribution
The United States was by far the most heavily targeted country during the last quarter, accounting for nearly half of all observed ransomware attacks in early 2026. The United Kingdom, Australia, and other Western nations also saw increased activity—often tied to specific campaigns by dominant ransomware groups.
Industry Targets
Certain industries proved particularly vulnerable:
- Construction, professional services, and manufacturing saw frequent ransomware incidents, likely due to outdated infrastructure and limited protective controls.
- IT and technology firms continued to be targeted for both their inherent value and their role within multiple supply chains.
Other sectors, including healthcare, retail, and education, also reported persistent ransomware activity in 2025, underscoring that no organization is immune.
What This Means for 2026
The Q4 2025 data suggests ransomware remains a dominant and escalating threat in the global cybersecurity landscape. The combination of high attack volumes, new and resurgent threat actors, and sophisticated extortion techniques signals that traditional defenses alone are insufficient.
Key strategic insights for organizations include:
- Strengthening identity and access controls to guard against credential theft and lateral movement.
- Tightening supply chain risk management and vendor oversight.
- Implementing robust data backup and recovery procedures to reduce the leverage of extortion.
- Enhancing real-time threat intelligence and dark web monitoring to anticipate attacker behavior.
The trends observed in Q4 2025 reinforce a crucial reality: ransomware groups are not only continuing their operations but are refining, expanding, and experimenting with new tactics. Proactive, intelligence-driven defenses will be essential to contain the rising tide of cyber extortion.
