Ransomware deployment speed increased by 48% as observed in 2025

In 2025, 77.7% of ransomware attacks were attributed to other actors outside the top five groups.

The top five ransomware groups — Qilin, Clop, Akira, Play, and SafePay — were responsible for 938 incidents, accounting for nearly 25% of all ransomware attacks in 2025.

Out of 103 active ransomware groups, five groups accounted for nearly 25% of global ransomware incidents.

Qilin was responsible for 248 incidents, Clop for 246 incidents, Akira for 209 incidents, Play for 120 incidents, and SafePay for 115 incidents in 2025.

In 2025, 5.9% of ransomware attacks were attributed to Qilin, 5.9% to Clop, 5.0% to Akira, 2.9% to Play, and 2.7% to SafePay.

In 2025, there were 103 distinct ransomware threat actors observed targeting critical infrastructure.

Organizations in the UAE paid ransoms that were 26% higher than the global average, with an average payment of $5.4 million

29.27% of ransomware incidents involved initial access as the detected phase.

Unnamed Fortune 50 company reported a ransom payment of $75 million

On average, organizations take just over 2 weeks to respond to and contain a security alert from initial detection to resolution.

Critical industries globally, such as government and transportation, face an average response time of upwards of 3 weeks to security alerts.

In the United States, organizations experience an average response time of 2.8 weeks to security alerts.

The average ransomware payout was $3.6 million

Organizations cited an average dwell time of nearly 2 weeks for threat actors prior to a ransomware incident.

22.00% of ransomware incidents involved lateral movement and privilege escalation as the detected phase.

12.00% of ransomware incidents involved data exfiltration as the detected phase.

Organizations estimated that ransomware actors had access to their systems for an average of 2 weeks

The healthcare sector had the highest average ransom payment at $7.5 million

The average ransom payment in 2023 was more than $3.6 million, an increase from last year's average of $2.5 million