Ransomware Victim Numbers Rise, Despite Drop in Active Extortion Groups

ReliaQuest's Q4 2025 report found a surge in ransomware data-leak site postings (up ~50% quarter‑on‑quarter and ~40% year‑on‑year), with top offenders Qilin (>450 victims), Akira (>200 victims) and the newly emerged Sinobi (listings up >300%). The analysis highlights RaaS operators prioritizing rapid access and execution, continued use of credential-based access, living‑off‑the‑land lateral movement and data exfiltration, and recommends controls such as phishing-resistant MFA and strengthened exfiltration monitoring.