What This Report Covers
This edition covers the fourth quarter of 2025. It covers ransomware activity across 27 industries and 134 countries.
Key Findings of the Ransomware Trends Report Q4 2025
The report covers ransomware activity in the fourth quarter of 2025 and compares it with the other quarters of 2025, by group, sector, country and region.
- Qilin was the most active group in Q4 2025, with 481 recorded attacks.
- Small and mid-sized groups grouped as "Others" made up 46.3% of ransomware activity in 2025, ahead of Qilin (12.9%), Akira (9.3%) and Cl0p (6.4%).
- Manufacturing was the most targeted sector in 2025 at 24.1% of incidents, followed by technology (16.7%) and healthcare (10%).
- The United States accounted for 48.4% of incidents in 2025, followed by Canada (5.1%) and Germany (4.7%).
- North America took 53.5% of 2025 activity and EMEA 27.4%.
- The report lists the vulnerabilities ransomware groups exploited in the quarter. Among them are CVE-2025-10035 (Fortra GoAnywhere MFT), CVE-2025-55182 (React Server Components), CVE-2025-61882 and CVE-2025-61884 (Oracle E-Business Suite) and CVE-2024-21762 (Fortinet FortiOS SSL VPN).
The full PDF adds profiles of Qilin, Akira, Sinobi, Inc Ransom and Cl0p. It also covers the quarter's main ransomware news, critical vulnerabilities, tactics and techniques, and recommendations.
Topics include the top groups and emerging criminal business models, sector trends across manufacturing, technology, healthcare and public services, the most exploited CVEs and initial access vectors, and the concentration of attacks by region and country.
It also reviews real-world incidents affecting public infrastructure and global enterprises, helping teams move from reactive defense to intelligence-driven risk management. See the ransomware glossary entry for the term.
As the final edition of 2025, it also gives a year-end view that security leaders can use for budgeting and planning. Its scale in groups, industries and countries is larger than the earlier editions of the year.
Sector-Specific Intelligence. Global Impact.
Ransomware activity in Q4 2025 was driven by highly organized threat actors, aggressive exploitation of internet-facing vulnerabilities, and precision targeting of operationally critical sectors.
Brandefense’s Ransomware Trends Report Q4 2025 covers 27 industries across 134 countries, delivering actionable intelligence for security leaders and risk teams.
What’s Inside the Report
- Top ransomware groups and emerging criminal business models
- Sector-based attack trends across manufacturing, technology, healthcare, and public services
- Most exploited CVEs and initial access vectors
- Regional and country-level ransomware concentration
- Real-world incidents impacting public infrastructure and global enterprises
Built by the Brandefense Cyber Threat Intelligence Team, this report helps organizations move from reactive defense to intelligence-driven ransomware risk management.
👉 Download the report to understand what ransomware actors know—and how they operate.