Akira, Clop Top List of 5 Most Active Ransomware-as-a-Service Groups

Flashpoint’s midyear 2025 ransomware report places Akira and Cl0p at the top of the five most prolific RaaS groups, alongside Qilin, Safepay and RansomHub. Akira is noted for a recent campaign that targeted a SonicWall vulnerability, while Cl0p has been linked to widespread fallout from zero‑days in managed file transfer products such as Cleo and Progress Software. Qilin is highlighted for a significant attack that disrupted services for the U.K.’s National Health Service partner, Synnovis.

Safepay, a newer entrant, claimed responsibility for an attack against technology distributor Ingram Micro and shares code with now‑defunct LockBit and Conti gangs. RansomHub emerged more recently and has targeted U.S. government organisations, though the group may have disbanded; alternatively, operators could be rebranding or joining other groups.

According to Flashpoint, ransomware rebranding is a known phenomenon, with groups like Safepay sharing code with former rivals, and AI features increasingly appearing in the RaaS toolkit, including LLMs used by Funksec and WormGPT in phishing templates.