Check Point Research’s Q3 2025 Ransomware Report shows how ransomware activity has remained at record-high levels, despite global enforcement efforts. However, the industry is more fragmented and dynamic than ever, with new groups emerging and old ones rebranding or resurfacing.
Highlights from this quarter’s findings:
- Fragmentation deepens, with affiliates shifting rapidly between brands, complicating attribution.
- New players rise: Groups like d4rk4rmy and Sinobi show fast expansion and aggressive tactics.
- Data-first extortion dominates, with encryption no longer the primary weapon.
- Multi-channel coercion, from Public leaks to DDoS, and media outreach to amplify pressure.
Download Now
By the Numbers: Q2 2025 Snapshot
1,592 Organizations publicly listed on ransomware leak sites in Q2 2025
85 active groups, including 14 new entrants, signal a volatile and expanding ecosystem.
Decentralization accelerates: Top 10 groups now account for just 56% of attacks.
