Q3 2025 ransomware victim disclosures remained elevated across monitored leak sites
Target Trend
Summary
Hide ▲
Show ▼
Ransomware victim disclosures remained elevated in Q3 2025, with 1,592 new victims posted across more than 85 leak sites. The average of 535 disclosures per month shows sustained extortion pressure across a broad operator set. The trend matters because a fragmented ecosystem can keep victim volume high even when individual brands are disrupted.
Related Happenings
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor Meta
First: 31.03.2026 15:15
Last: 31.03.2026 15:15
Sources 1
About this happening:
TeamPCP and **Vect ransomware group** are linking **supply-chain compromises** to **follow-on ransomware campaigns**, broadening extortion risk for affected organizations. The shi...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor MetaAbout this happening: TeamPCP and **Vect ransomware group** are linking **supply-chain compromises** to **follow-on ransomware campaigns**, broadening extortion risk for affected organizations. The shi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor Meta
First: 19.03.2026 18:00
Last: 19.03.2026 18:00
Sources 1
About this happening:
**hastalamuerte** exposed the internal workings of **The Gentlemen** ransomware group, revealing a **Qilin-related RaaS split** that shows how affiliate-driven ecosystems can rapi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor MetaAbout this happening: **hastalamuerte** exposed the internal workings of **The Gentlemen** ransomware group, revealing a **Qilin-related RaaS split** that shows how affiliate-driven ecosystems can rapi...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
Target Trend
First: 17.03.2026 23:41
Last: 17.03.2026 23:41
Sources 1
About this happening:
**Ransomware operators** are increasingly leaning on **built-in Windows tooling** while **ransom payment rates** continue to decline across **2025**, weakening extortion returns f...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
Target TrendAbout this happening: **Ransomware operators** are increasingly leaning on **built-in Windows tooling** while **ransom payment rates** continue to decline across **2025**, weakening extortion returns f...
Ransomware victim payment rates hit record low as claimed attacks surged
Target Trend
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates **fell to 28%** last year, an all-time low, even as **claimed attacks** rose **50% year-over-year**. The divergence suggests extortion operations a...
Ransomware victim payment rates hit record low as claimed attacks surged
Target TrendAbout this happening: Ransomware victim payment rates **fell to 28%** last year, an all-time low, even as **claimed attacks** rose **50% year-over-year**. The divergence suggests extortion operations a...
Ransomware victim payment rates fall to record low as claimed attacks rise
Target Trend
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates fell to **28%** last year, a record low, even as claimed attacks rose **50% year over year**, signaling a widening gap between attack volume and re...
Ransomware victim payment rates fall to record low as claimed attacks rise
Target TrendAbout this happening: Ransomware victim payment rates fell to **28%** last year, a record low, even as claimed attacks rose **50% year over year**, signaling a widening gap between attack volume and re...
Timeline
-
14.11.2025 12:37 2 articles · 6mo ago
Initial report: Q3 2025 ransomware victim disclosures remained elevated across monitored leak sites
Initial DisclosureIn **Q3 2025**, monitored leak sites recorded **1,592 new ransomware victims**, confirming sustained disclosure activity across the ecosystem.
Show sources
- Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns — thehackernews.com — 14.11.2025 12:37
- Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns — thehackernews.com — 14.11.2025 12:37