Loading story…
Ransomware activity accelerated sharply from late 2025 into early 2026, with Black Kite tracking 7,551 known victims worldwide during a 12-month study period and attributing the rise to a fragmented criminal ecosystem rather than AI alone. More than 60 new ransomware groups entered the market, established operators including Qilin, Everest, Cl0p, and World Leaks remained active, and attackers increasingly shifted toward smaller, less-defended organizations. Manufacturing was the most targeted sector, US organizations accounted for nearly half of observed victims, and Europe recorded a faster growth rate than the US.
The surge is intensifying pressure on victims to decide whether to pay, with reporting citing 2025 Sophos research that nearly half of targeted companies ultimately paid ransom demands and that median demands are rising globally. Security practitioners and policy debates are now focusing on whether public-sector payment bans would curb attacker profits or instead raise cyber-insurance costs and expand demand for negotiators, incident responders, and breach coaches. Across the reporting, defenders emphasized that the most effective response is stronger exposure management, continuous monitoring, MFA, least-privilege access, resilient backups, and better visibility into third-party and SaaS risk before compromise occurs.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Black Kite's 2026 Ransomware Report said 61 new ransomware groups entered the market during its April 2025 to March 2026 study period, and the number of active groups reached 146 by June 2026. The report also identified Qilin as the highest-volume operator amid a fragmented ecosystem.
A 2025 Sophos study found that nearly half of companies targeted by ransomware ultimately paid a ransom to recover data or systems. The reporting also noted that median ransom demands were rising globally.
According to Black Kite, ransomware activity increased significantly from October 2025 through March 2026. The acceleration was attributed primarily to the splintering ransomware landscape rather than AI alone.
Black Kite identified 7,551 known ransomware victims worldwide during its study period spanning April 2025 to March 2026. The report cited ecosystem fragmentation, more than 60 new groups, and increased targeting of smaller organizations as key drivers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcemalware.news
Open sourcedarkreading.com
Open sourcearstechnica.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026
Ransomware groups are experiencing a significant decline in payment rates, with only 23% of victims paying ransoms in Q3 2025, according to Coveware. This trend is attributed to organizations implementing stronger defenses, increased law enforcement pressure, and a growing understanding that paying to suppress stolen data offers little benefit. The average and median ransom payments have also dropped, with figures reaching $377,000 and $140,000, respectively. Ransomware-as-a-Service groups like Akira and Qilin are adapting by targeting different market segments, but even high-profile data exfiltration campaigns have yielded limited returns for attackers. As payments decrease, ransomware actors are shifting their tactics, focusing more on data exfiltration—now the primary objective in over 76% of observed attacks—and exploring new methods of initial access. Notably, there has been a rise in insider threats, with attackers bribing employees for credentials or remote access, and an evolution in helpdesk social engineering techniques. These changes reflect a more targeted and inventive approach by threat actors as they seek to overcome improved organizational defenses and maximize their chances of financial gain.
Jun 29, 2026
Ransomware attacks continue to pose a significant threat to organizations, with recent surveys indicating that paying the ransom does not guarantee successful data recovery. According to Hiscox’s Cyber Readiness Report, only 60% of companies that paid a ransom were able to recover all or part of their data, while 40% lost their data despite payment. The technical sophistication of ransomware operators varies, with established groups more likely to provide functional decryptors, but many victims still face flawed encryption or unresponsive attackers. Additionally, the frequency of ransomware incidents has surged, with reports showing a near tripling of cases year-over-year in early 2025, and a majority of victims experiencing data theft even after paying ransoms. The ransomware landscape has evolved from high-volume, opportunistic attacks to a "big game hunting" model, where adversaries selectively target organizations with the most to lose and the greatest ability to pay. New criminal syndicates such as Spoiled Scorpius (RansomHub) and Howling Scorpius (Akira) are conducting sophisticated, long-term campaigns against high-value targets, often employing multi-extortion tactics that combine data encryption with threats of public exposure. This strategic shift has transformed ransomware from a purely IT issue into a critical business continuity threat, requiring organizations to adopt new defensive strategies and prepare for more calculated, high-impact attacks.
Jun 29, 2026