Top 10 Ransomware Groups of 2025

The Top 10 Ransomware Groups of 2025 show an ecosystem that shifted from centralised factions to a more fragmented, collaborative landscape, with groups mixing brands and affiliates and reusing tooling across campaigns. Scattered Lapsus$ Hunters topped the list by leveraging social engineering to scale attacks against enterprise SaaS environments, rather than relying on software vulnerabilities.

Qilin (Agenda) ranked second as an RaaS operation that surpassed 1,000 listed victims and integrated legal and psychological pressure into extortion. Akira Ransomware added nearly 740 victims, while Cl0p Ransomware, active in Oracle EBS exploitation, claimed more than 500 victims and highlighted high‑impact CVEs such as CVE-2025-61882 and CVE-2025-61884.

The report notes that Fortinet found 73% of organisations experienced at least one ransomware incident in 2025, with only 60% of data restored on average and just 4% of victims recovering all data. Beyond encryption, groups increasingly pursued data theft, double extortion, and supply‑chain abuse, with incidents spreading across industries and geographies.