ReportRansomware Trends Reports
Published 18 Apr 2025Updated 16 Oct 2026
What This Report Covers
This edition covers the first quarter of 2025, from January to March. Brandefense CTI analysts tracked 38 active threat groups and documented incidents across 22 industry sub-sectors. Compared with the fourth quarter of 2024, the report shows fewer incidents in the main sectors and countries it compares.
Key Findings of the Ransomware Trends Report Q1 2025
The report covers ransomware activity from January to March 2025 and compares it with the last quarter of 2024. It is based on 1,038 studied incidents from 38 active threat groups across 22 industry sub-sectors.
- RansomHub was the most active named group with 22.3% of detected attacks, followed by Lynx (11.3%) and Cactus (9.1%). The "Others" category held 23.6%.
- Lynx, Cactus and Incransom nearly tripled their activity compared with Q4 2024.
- Manufacturing was the top target at 20.5% of attacks, followed by business services (12%) and construction (10.2%).
- Reported incidents fell in all five key sectors the report compares with Q4 2024, manufacturing and business services among them.
- The United States accounted for 61.3% of reported incidents, followed by Canada (7.3%) and the United Kingdom (4.5%). The report shows fewer attacks on each of these countries than in Q4 2024.
- North America accounted for 69% of attacks.
The full PDF adds profiles of RansomHub, Lynx, Play and Incransom, the quarter's main ransomware news stories, an analysis of critical vulnerabilities, tactics and techniques, a conclusion and recommendations.
Manufacturing took 20.5% of attacks, business services 12% and construction 10.2%. The report also reviews notable ransomware events of the quarter, and the tactics, techniques and exploited vulnerabilities used by different groups.
Security leaders can use it to see current conditions and plan protective steps. The ransomware glossary entry explains the term for newer readers.
It is the first edition of 2025 and sits at the start of the quarterly sequence for that year, so it can be read as the baseline against which the later 2025 editions can be compared.
Ransomware in Q1 2025: Groups, Sectors and Countries
Download our comprehensive Q1 2025 Ransomware Trends Report, which compares ransomware activity with Q4 2024. Brandefense CTI Analysts tracked 38 active threat groups during January, February, and March 2025, documenting devastating ransomware incidents across 22 industry sub-sectors.
Our findings reveal concerning distribution patterns with 20.5% of attacks targeting Manufacturing, 12% affecting Business Services, and 10.2% impacting the Construction sector. The report includes a detailed analysis of notable ransomware events from the past three months, providing context and refreshing readers on significant attacks that made headlines.
Security leaders will gain valuable insights into the evolving tactics, techniques, and vulnerability exploitations employed by various ransomware groups. This essential intelligence allows organizations to understand current threat landscapes and implement proactive security measures to protect against future attacks.
Download now to strengthen your organization’s cybersecurity strategy with actionable intelligence from Brandefense’s expert threat analysts.