The State of Ransomware – Q3 2025

This Q3 2025 ransomware intelligence report documents a record-high fragmentation of the extortion ecosystem with 85 active data-leak sites and 1,592 newly published victims, sustained high monthly victim rates (~520–540/month), the dominance of Qilin and other emergent groups, and the re-emergence of LockBit 5.0 — an upgraded RaaS variant with cross-platform capabilities — signaling potential re-centralization of affiliates and an elevated operational risk to organizations across multiple sectors and countries.