The FBI’s 2025 IC3 annual report names ten ransomware variants among those most frequently reported to the FBI via IC3 in 2025: Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, Ransomhub, Lockbit, Dragonforce, SAFEPAY and Medusa. This article lists them in the report’s own order and summarizes the sectors and advice the report gives.
- 3,600+Ransomware complaints received by IC3 in 2025Source: FBI 2025 IC3 Annual Report
- $32 million+Losses reported with those complaintsSource: FBI 2025 IC3 Annual Report
- 63New ransomware variants identified via IC3Source: FBI 2025 IC3 Annual Report
What does the IC3 report say about ransomware in 2025?
The report says ransomware “is among the highest reported cyber threats targeting critical infrastructure organizations.” It describes ransomware as malicious software designed to block access to a computer system until money is paid. For 2025, IC3 received more than 3,600 complaints reporting ransomware, with losses exceeding $32 million.
The report also says 63 new ransomware variants were identified via IC3, an average of 5.25 new variants per month. Read more about what ransomware is in our glossary.
Which ten ransomware variants were reported most to the FBI in 2025?
The report calls these variants “among those most frequently reported variants to the FBI via IC3.” It presents them as a numbered list headed “Top 10 Reported Variants.” The numbers follow the report’s order. The report does not say the order is a ranking by losses, so this article does not treat it as one.
- Akira
- Qilin
- INC./Lynx/Sinobi
- BianLian
- Play
- Ransomhub
- Lockbit
- Dragonforce
- SAFEPAY
- Medusa
The report says Joint Cyber Security Advisories (JCSAs) are available to learn more about several of these variants. Our profiles for two of the names are on Akira and LockBit.
How much of the 2025 reporting do these ten variants account for?
According to the report, the ten variants account for 56.8% of the total number of ransomware incidents reported. The loss amount attributed to them is over $16 million, almost half (49.8%) of the total losses reported.
The report adds several limits. Adjusted losses do not normally include estimates of lost business, time, wages, files or equipment, or any third-party remediation services. In some cases entities do not report any loss amount, which creates an artificially low overall ransomware loss rate. The numbers also cover only what entities report to the FBI via IC3, not reports made directly to FBI field offices.
Which sectors did the top ransomware variants hit?
The report says the top 10 reported ransomware variants most impacted three critical sectors: Critical Manufacturing, Healthcare and Public Health, and Government Facilities. It notes that there are 16 critical infrastructure sectors in total.
The report also covers organizations outside those sectors. IC3 received more than 1,400 ransomware complaints from businesses and organizations not related to a critical sector. The most reported industries among them were:
- Legal services, 18% (law firms, estate planning)
- Contracting services, 17% (electricians, general contractors)
- Engineering and architectural services, 10%
- Consulting services, 7%
- Non-critical manufacturing, 5%
CISA’s #StopRansomware Guide says attackers have also exfiltrated victim data and pressured victims by threatening to release it, which it calls double extortion. Our glossary explains double extortion. The IC3 report does not describe how each variant extorts victims.
The report’s critical infrastructure section gives a chart of complaints categorized as ransomware and data breach complaints related to one of the 16 critical infrastructure sectors. This article does not quote the per-sector chart values. The sector statement for the top 10 variants is the one above.
What does the FBI recommend to protect against ransomware?
The report says the FBI recommends a foundation of industry best practices to limit damage and lower risk. Its practices for companies are summarized below.
- Back up off-site or offlineEncrypted, immutable backups covering the whole organization.
- Remove default credentialsApply NIST standards to every account with a password login.
- Remove unneeded protocolsAudit admin accounts and use least privilege.
- Enable MFAFor all services where possible, especially webmail, VPNs and critical systems.
- Log and report network trafficEDR tools help detect lateral connections.
- Segment networksRestrict lateral movement between subnetworks.
- Patch promptlyPrioritize known exploited vulnerabilities in internet-facing systems.
On detection, the report says to implement a tool that logs and reports all network traffic, including lateral movement activity. It says endpoint detection and response (EDR) tools are particularly useful for detecting lateral connections because they have insight into common and uncommon network connections for each host. On segmentation, it says controlling traffic flows between subnetworks and restricting adversary lateral movement can help prevent the spread of ransomware. On patching, it calls timely patching “one of the most efficient and cost-effective steps” an organization can take to minimize its exposure.
The report also asks victims of ransomware or cybercrime to file a report with IC3 to share information with the FBI. For a longer list of mitigations it points to the #StopRansomware Guide from CISA.
What should security teams ask after reading the report?
These checks follow from the report’s stated facts and recommendations.
- The three most impacted sectors are Critical Manufacturing, Healthcare and Public Health, and Government Facilities. Does your organization or a key supplier sit in one of them?
- The report recommends immutable backups that cover the entire infrastructure. Do yours, and has restoration been tested?
- The report recommends MFA on webmail, VPNs and accounts that access critical systems. Is it enforced there?
- The report recommends patching known exploited vulnerabilities in internet-facing systems first. Is that list tracked?
For context from other sources, see our reading of the top 5 ransomware groups in Q2 2026, the Q2 2026 ransomware trends report, and ransomware fragmentation and attribution across 146 groups.
Related reading: the FBI IC3 costliest crimes and the most targeted EU sectors.