The State of Ransomware – Q3 2025

The Q3 2025 ransomware landscape saw fragmentation reach new extremes, with more than 85 active data leak sites listed across the quarter and 1,592 new victims published, up from 1,607 in Q2 2025 and well above the 1,270 victims in Q3 2024. Check Point Research notes that the overall number of active threat actors continued to grow, driven by a steady expansion of double-extortion activity and a rise in smaller operators moving away from traditional RaaS templates.

Qilin remained the most active group, averaging around 75 victims per month, while LockBit 5.0 returned in September 2025, reigniting questions about re-consolidation around a major brand. The report highlights ongoing affiliate mobility, with 45 newly observed actors in 2025 and 47 groups publishing fewer than ten victims, suggesting a shift toward a more dispersed ecosystem.

US organisations were disproportionately affected, with approximately 65 percent of identified attacks targeting the United States, and the remainder impacting Mexico, Indonesia, and several European countries, as attackers diversified across sectors and geographies.