Q3 2025 ransomware victim disclosures remained elevated across monitored leak sites
Trend
Summary
Hide ▲
Show ▼
Ransomware victim disclosures remained elevated in Q3 2025, with 1,592 new victims posted across more than 85 leak sites. The average of 535 disclosures per month shows sustained extortion pressure across a broad operator set. The trend matters because a fragmented ecosystem can keep victim volume high even when individual brands are disrupted.
Related Happenings
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor Meta
H score11
First: 31.03.2026 15:15
Last: 31.03.2026 15:15
Sources 1
About this happening:
TeamPCP and Vect ransomware group are linking supply-chain compromises to follow-on ransomware campaigns, broadening extortion risk for affected organizations. The shi...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor MetaAbout this happening: TeamPCP and Vect ransomware group are linking supply-chain compromises to follow-on ransomware campaigns, broadening extortion risk for affected organizations. The shi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor Meta
H score25
First: 19.03.2026 18:00
Last: 19.03.2026 18:00
Sources 1
About this happening:
hastalamuerte exposed the internal workings of The Gentlemen ransomware group, revealing a Qilin-related RaaS split that shows how affiliate-driven ecosystems can rapi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor MetaAbout this happening: hastalamuerte exposed the internal workings of The Gentlemen ransomware group, revealing a Qilin-related RaaS split that shows how affiliate-driven ecosystems can rapi...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
Trend
H score32
First: 17.03.2026 23:41
Last: 17.03.2026 23:41
Sources 1
About this happening:
Ransomware operators are increasingly leaning on built-in Windows tooling while ransom payment rates continue to decline across 2025, weakening extortion returns f...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
TrendAbout this happening: Ransomware operators are increasingly leaning on built-in Windows tooling while ransom payment rates continue to decline across 2025, weakening extortion returns f...
Ransomware victim payment rates hit record low as claimed attacks surged
Trend
H score51
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates fell to 28% last year, an all-time low, even as claimed attacks rose 50% year-over-year. The divergence suggests extortion operations a...
Ransomware victim payment rates hit record low as claimed attacks surged
TrendAbout this happening: Ransomware victim payment rates fell to 28% last year, an all-time low, even as claimed attacks rose 50% year-over-year. The divergence suggests extortion operations a...
Ransomware victim payment rates fall to record low as claimed attacks rise
Trend
H score61
First: 26.02.2026 16:00
Last: 26.02.2026 16:00
Sources 1
About this happening:
Ransomware victim payment rates fell to 28% last year, a record low, even as claimed attacks rose 50% year over year, signaling a widening gap between attack volume and re...
Ransomware victim payment rates fall to record low as claimed attacks rise
TrendAbout this happening: Ransomware victim payment rates fell to 28% last year, a record low, even as claimed attacks rose 50% year over year, signaling a widening gap between attack volume and re...
Timeline
-
14.11.2025 12:37 2 articles · 8mo ago
Initial report: Q3 2025 ransomware victim disclosures remained elevated across monitored leak sites
Initial DisclosureIn Q3 2025, monitored leak sites recorded 1,592 new ransomware victims, confirming sustained disclosure activity across the ecosystem.
Show sources
- Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns — thehackernews.com — 14.11.2025 12:37
- Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns — thehackernews.com — 14.11.2025 12:37