Average ransom payment doubles in a single quarter
Targeted social engineering and data exfiltration have become the biggest tactics as three major ransomware groups dominate
Ransom payouts hit record levels this quarter, thanks to a dramatic rise in targeted social engineering attacks.
Analysis from Coveware by Veeam showed that the average ransom payment rocketed to $1.13 million - up 104% from the first quarter. The median payment rose by a similar amount, doubling to $400,000.
This surge was largely down to an increase in payments by larger organizations hit by data exfiltration-only incidents.
The study noted that data theft has now overtaken encryption as the primary extortion method, with exfiltration a factor in 74% of all cases. Meanwhile, multi-extortion tactics and delayed threats are on the rise.
"The second quarter of 2025 marks a turning point in ransomware, as targeted social engineering and data exfiltration have become the dominant playbook,” said Bill Siegel, CEO of Coveware by Veeam.
“Attackers aren’t just after your backups – they’re after your people, your processes, and your data’s reputation."
The quarter’s top ransomware variants were Akira (19%), Qilin (13%), and Lone Wolf (9%), while Silent Ransom and Shiny Hunters entered the top five for the first time.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
Ransomware groups target precision
The biggest threats involved social engineering attacks from three major ransomware groups – Scattered Spider, Silent Ransom, and Shiny Hunters.
These groups have now abandoned mass opportunistic attacks for precision strikes, using new impersonation tactics against help desks, employees and third-party service providers.
They regularly exploit vulnerabilities in widely-used platforms such as Ivanti, Fortinet VMware and Windows services, often right after a vulnerability has been publicly disclosed.
Meanwhile, 'lone wolf' attacks by extortionists using generic, unbranded toolkits are on the rise. allowing even mid-tier actors to breach enterprise infrastructure.
Insider threats escalate
Insider and third-party access risks showed an uptick in the quarter, particularly involving business process outsourcing (BPO) partners, contractors, and IT service providers.
"These external parties often hold privileged access but operate outside core security oversight, making them a growing vector of exploitation for credential misuse or social engineering," the researchers point out.
The worst-hit industry sector was professional services at 20%, followed by healthcare and consumer services at 14% each.
Mid-sized companies with between 11 and 1,000 employees made up 64% of victims - a sweet spot, researchers noted, for attackers balancing payout potential against less mature defenses.
Before exfiltrating or encrypting data, attackers are putting effort into mapping networks, enumerating assets and identifying the most valuable systems or datasets. This reconnaissance phase often relies on legitimate admin tools or built-in OS commands, making it hard to spot without contextual analysis.
If it can be detected, though, by monitoring for anomalous enumeration or employing deception technologies such as decoy credentials, honeyfiles or fake infrastructure, this phase can act as an early warning system.
"Organizations must prioritize employee awareness, harden identity controls, and treat data exfiltration as an urgent risk, not an afterthought," advised Siegel.
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- A major ransomware hosting provider just got hit US with sanctions
- Ransomware victims are getting better at haggling with hackers
- The new ransomware groups worrying security researchers in 2025
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
UK manufacturers urged to bolster resilience as cyber threats surgeNews Growing cyber threats mean manufacturers need to shake up resilience strategies and preparedness
-
OpenAI has paused work on its Astra AI model after it passed a “critical threshold” in cyber capabilityNews The firm said it's Astra model can "develop functional zero-day exploits of all severity levels"
-
Companies are still paying ransoms to cyber criminals despite official adviceNews A Proofpoint survey found evolving ransomware techniques and the use of AI is exacerbating the situation for victims
-
This one cyber crime group accounted for nearly a fifth of all ransomware attacks in JuneNews The Gentlemen, a ransomware a service operator, now accounts for 17% of published attacks
-
Working with the enemy: Ransomware negotiator-turned cyber criminal jailed after working with hackers to extort clientsNews Angelo Martino was supposed to be negotiating on behalf of victims, but was secretly working for ransomware operators
-
Hackers are posing as Interpol to target small businesses – here's what you need to knowNews Small businesses are warned to think twice before clicking on links
-
‘Every hour ransomware goes undetected drastically increases its potential blast radius’: Hackers are breaching networks and laying low for longer – and nearly half of firms don’t realize until data is stolenNews An ExtraHop survey found more intrusions are going undetected, leading to longer dwell times
-
Ransomware cartels are fragmenting into volatile splinter groups, warns Met Police cyber chiefNews Commoditized "cyber crime bazaars" and AI data mining are forcing law enforcement to rewrite its playbook
-
New ransomware threat group, The Gentlemen, has become one of the most active ransomware operators, accounting for 10% of all attacksNews NTT researchers warn that the RaaS group is leveraging SystemBC malware to establish covert tunnelling, evade detection, and support rapid lateral movement across enterprise environments
-
Instructure chose to a pay ransom following the Canvas cyber attack – research shows more than half of security leaders would follow suitAnalysis Opting to pay ransoms creates huge risks for enterprises – you’re relying on the word of criminals