Ransomware Actors Targeting Global Public Sectors and Critical Infrastructure

According to Trustwave’s SpiderLabs research team, nearly 200 public sector organisations have been struck with ransomware in 2025, with Babuk and Qilin emerging as the most prolific threat groups driving attacks on critical infrastructure and government services. The financial and operational toll includes Comparitech’s finding that ransomware attacks against government entities between 2018 and 2024 resulted in $1.09 billion in operational downtime costs.

In the first seven months of 2025, Trustwave’s data identified 196 confirmed public sector ransomware victims, signalling a troubling acceleration, while the United States alone accounted for 69 confirmed public sector incidents. The threat landscape shows fragmentation, with groups such as Rhysida, SafePay, RansomHub, and DragonForce having claimed multiple attacks, and a shift towards data extortion where information is stolen and threatened with public disclosure.

Government entities faced the highest average ransom demands across sectors, and a first-half 2025 trend noted a 60% increase in government-targeted incidents, alongside a 47% global rise versus the same period in 2024.