Top Ransomware Groups Of May 2025 SafePay And DevMan Rise

May 2025 ransomware landscape: SafePay rose to the top of claimed victims as ransomware activity continued across the U.S. and other regions; DevMan emerged as an expanding affiliate actor using faster lateral movement and GPO deployment, while a VanHelsing RaaS source-code leak and multiple new groups (Dire Wolf, DATACARRY, J) raise the risk of copycats and increased operations. The report lists 384 claimed victims in May, highlights high-impact alleged breaches affecting diverse sectors (including potential supply-chain and critical-infrastructure impacts), documents typical TTPs (VPN/RDP credential access, password spraying, double extortion), and reiterates standard defensive controls and monitoring recommendations.