The ransomware boom shows no signs of letting up – and these groups are causing the most chaos
Thousands of ransomware cases have already been posted on the dark web this year
The first half of this year saw a sharp rise in the number of ransomware attacks, with US companies, small and medium-sized businesses (SMBs), and manufacturing firms among the hardest hit.
Between January and June, 4,198 ransomware cases were exposed on the dark web, up 49% from the 2,809 cases recorded in 2024, according to data compiled by NordStellar.
"We're only halfway into the year, but the number of ransomware attacks has already doubled, signifying that these attacks remain effective and profitable enough for cyber criminals to ramp up their efforts," said Vakaris Noreika, a cybersecurity expert at NordStellar.
"Some factors that could contribute to the growth in ransomware attacks include the rise in Ransomware as a Service (RaaS), expanded attack surfaces from remote or hybrid work models and economic uncertainty that could encourage more people to seek illegal income and turn to cybercrime."
US businesses were hit the hardest, accounting for 596 incidents - 49% of all cases - followed by Germany with 84, Canada with 74, the UK with 40, and Spain with 37.
"Not only is the US home to many profitable businesses, but the companies also have a higher profile. As a result, they're more likely to give into ransomware demands to reduce the impact of the reputational damage resulting from an attack", said Noreika.
"Strict regulations are also a significant factor to consider — laws on data protection and operational uptime can urge companies to resolve ransomware incidents quickly and not risk the fines or loss of their clients and partners' trust."
There were 223 recorded cases in the manufacturing industry alone, followed by construction with 97 and the IT industry with 88.
Researchers noted that this is because of challenges enforcing and centralizing security across geographically dispersed locations, as well as a reliance on outdated and unpatched systems.
The top ransomware players of 2025 so far
Meanwhile, organizations with between 51 and 200 employees and with revenues between $5 million and $25 million faced the most ransomware attacks.
This may be due to a reliance on third-party IT providers and a lack of comprehensive cybersecurity measures, the study noted.
Qilin was the busiest ransomware group during the second quarter of this year, with 214 attacks, followed by SafePay - believed to be responsible for an attack on Ingram Micro earlier this month - with 201 incidents, and Akira with 200.
Researchers stressed the importance of cybersecurity training to tackle phishing scams, along with the use of multi-factor authentication (MFA) and strict password management.
"Aside from raising cybersecurity awareness, companies should also build a comprehensive cybersecurity strategy to detect threats before they escalate," said Noreika.
"This includes implementing endpoint protection, monitoring the dark web for potential data leaks, and keeping a close eye on the company's attack surface for unpatched security vulnerabilities."
Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.
MORE FROM ITPRO
- The new ransomware groups worrying security researchers in 2025
- Ransomware victims are getting better at haggling with hackers
- A major ransomware hosting provider just got hit US with sanctions
-
Salesforce targets telco gains with new agentic AI toolsNews Telecoms operators can draw on an array of pre-built agents to automate and streamline tasks
-
Four national compute resources launched for cutting-edge science and researchNews The new national compute centers will receive a total of £76 million in funding
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Ransomware gangs are sharing virtual machines to wage cyber attacks on the cheap – but it could be their undoingNews Thousands of attacker servers all had the same autogenerated Windows hostnames, according to Sophos
-
Google issues warning over ShinyHunters-branded vishing campaignsNews Related groups are stealing data through voice phishing and fake credential harvesting websites
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
