Ransomware payments cratered in 2025 - attacks did not

"Despite the relative stability in total payments, ransomware attacks surged across multiple vectors in 2025, with eCrime.ch data showing a 50 percent YoY increase in claimed ransomware victims, marking the most active year on record."

"Smaller, opportunistic groups are behind a growing share of extortion attempts, even as the old guard - LockBit, BlackCat, and friends - have been raided, sanctioned, arrested, or simply popped back up under new logos. What's left is a crowded field of spin-offs and opportunists taking their chances."

"The median ransom demand jumped from $12,738 in 2024 to $59,556 in 2025, and the number of publicly claimed attacks climbed along with it, while the share of victims paying dropped to an all-time low of 28 percent."

Ransomware payments fell to $820 million in 2025, continuing a downward trend, while victim payment rates hit an all-time low of 28 percent. However, this apparent progress masks a deteriorating security landscape. Median ransom demands skyrocketed from $12,738 to $59,556, and claimed ransomware attacks increased 50 percent year-over-year, marking the most active year on record. Over 8,000 organizations were publicly named on leak sites in 2025. The shift reflects a fragmented threat landscape where smaller, opportunistic groups replace dismantled major gangs like LockBit and BlackCat, conducting numerous attacks with lower payment rates but higher individual demands.

Read at Theregister