What This Report Covers
This edition covers the second quarter of 2025. Brandefense threat intelligence analysts look at the most active ransomware groups, tactics such as double extortion, and shifts in victim geography and sector targeting.
Key Findings of the Ransomware Trends Report Q2 2025
The report covers ransomware activity from April to June 2025 and compares it with the first quarter. It is based on 1,354 studied incidents from 69 active threat groups across 21 industry sub-sectors.
- The "Others" category of smaller groups held 41.7% of incidents. Qilin led the named groups with 12.6%, followed by Akira (10.5%) and Safepay (7.4%).
- Manufacturing was the most targeted industry at 19% of incidents, followed by business services (15.3%), construction (13.9%) and retail (12.4%).
- The United States accounted for 45.9% of incidents, followed by Canada (5.4%) and Germany (5.2%).
- North America accounted for 51.3% of incidents and EMEA for 31.3%.
- Play rose from 84 incidents in Q1 to 97 in Q2 (+15.5%), while Lynx fell from 117 to 58 (-50.4%).
- RansomHub disappeared suddenly and DragonForce rose sharply in April 2025, which the report says triggered affiliate migrations. In May 2025 a breach of LockBit's infrastructure exposed its inner workings.
The full PDF adds profiles of Akira, INC Ransom, Sarcoma, DragonForce and Hunters. It also covers the LockBit breach, the RansomHub collapse and the Hunters International shutdown, plus critical vulnerabilities and recommendations.
The report sets out the top ransomware families of the quarter, the industries and regions affected, an analysis of tactics, techniques and procedures, the quarter’s main ransomware news and practical recommendations.
It is written for security professionals and business leaders who need to follow how the ransomware ecosystem is changing. The ransomware glossary entry gives a basic definition.
It is one of four 2025 editions on the site, sitting between the first quarter report and the third quarter report, which together show how the year developed.
Ransomware in Q2 2025: What You Need to Know
Ransomware continues to dominate the cyber threat landscape in 2025. In the latest Ransomware Trends Report Q2 2025, Brandefense threat intelligence analysts reveal the most active ransomware groups, trending tactics like double extortion, and shifts in victim geography and sectoral targeting.
This report helps security professionals and business leaders understand the evolving ransomware ecosystem—and prepare better defenses.
Download now to explore:
- The top ransomware families of Q2 2025
- Targeted industries and geographies
- Tactics, techniques, and procedures (TTPs) analysis
- The quarter’s main ransomware news and actionable recommendations