What This Report Covers
This edition covers the third quarter of 2025. It analyzes 1,422 ransomware incidents across 74 active groups and 20 industries.
Key Findings of the Ransomware Trends Report Q3 2025
The report covers ransomware activity from July to September 2025 and compares it with the second quarter. It is based on 1,422 studied incidents from 74 active threat groups across 20 industry sub-sectors.
- Qilin led with 15.2% of incidents (12.6% in Q2), followed by Akira (10.8%) and Incransom (8.2%, up from 4.3%). The "Others" category held 39.5%.
- Qilin rose from 171 incidents in Q2 to 216 in Q3 (+26.3%), and Incransom doubled from 58 to 116.
- Manufacturing remained the most targeted industry at 19.7% of incidents, followed by business services (16.1%), construction (11.7%) and retail (10.3%).
- The United States accounted for 51.6% of incidents, up from 45.9% in Q2, followed by Germany (5.0%) and Canada (4.6%).
- North America took 56.8% of incidents, up from 51.3% in Q2, while EMEA fell from 31.3% to 25.4%.
- The report describes an extortion wave in which cybercriminals used Claude Code to automate data theft and ransom operations across 17 organizations.
The full PDF adds profiles of Qilin, Akira, Play, Inc Ransom and Lynx. It also covers AI-powered data extortion, the Conti network exposure and the BlackSuit takedown, plus critical vulnerabilities and recommendations.
It describes how operations changed, from an AI-powered extortion wave to global law enforcement takedowns, and which sectors and regions were hit hardest. A comparison of second and third quarter metrics is included. It shows Inc Ransom doubling its incidents, while Qilin and Akira stayed the leading groups.
The aim is practical insight for resilience and readiness. For the basics of the threat, read the ransomware glossary entry.
This report sits between the second and fourth quarter editions of 2025. Together they give a year of ransomware reporting, and this one stands out for its focus on AI-driven extortion and enforcement actions.
Ransomware Trends Report Q3 2025 Is Here – Uncover Global Threat Patterns
The latest Brandefense Ransomware Trends Report (Q3 2025) delivers an in-depth analysis of 1,422 ransomware incidents across 74 active groups and 20 industries.
Explore how ransomware operations evolved, from AI-powered extortion waves to global law-enforcement takedowns, and learn which sectors and regions faced the heaviest impact.
Compare Q2 vs Q3 metrics, see how Inc Ransom doubled its incidents, and see how leaders like Qilin and Akira shaped the landscape.
📊 Gain practical insights to enhance resilience and readiness against evolving ransomware threats.