Akira, Cl0p Top List of 5 Most Active Ransomware-as-a-Service Groups

### Executive summary Flashpoint's mid‑2025 ransomware recap reports a 179% increase in ransomware incidents compared to H1 2024, driven by the RaaS model that enables lower-skilled affiliates. The report identifies top RaaS groups (Cl0p, Akira, Qilin, RansomHub), notes exploitation of unpatched and zero-day vulnerabilities in managed file transfer and remote monitoring tools, describes living‑off‑the‑land post‑compromise techniques, and highlights early, limited use of AI by some groups for phishing and tooling.