Cyberstats

Security Intelligence

KELA

Cybersecurity reports and statistics published by KELA

8 categories2 reports

Research Reports

Reports and publications from KELA

KELA Report - National Cybersecurity Report Ransomware.pdf

2025 Midyear Threat Report: Evolving Tactics and Emerging Dangers

Recent Statistics & Reports

In 2025, 5.9% of ransomware attacks were attributed to Qilin, 5.9% to Clop, 5.0% to Akira, 2.9% to Play, and 2.7% to SafePay.

Ransomware Ransomware groups

In 2025, 70.4% of ransomware attacks, totaling 3,310 incidents, were distributed across other regions.

Manufacturing has been the #1 targeted industry for ransomware attacks for four consecutive years, according to the IBM X-Force 2025 Threat Intelligence Index.

Ransomware manufacturing

In 2025, half of all ransomware attacks worldwide targeted essential sectors such as manufacturing, healthcare, energy, transportation, and finance, indicating a shift from opportunistic crime to systemic disruption.

Between January and September 2025, KELA observed 4,701 ransomware incidents, representing a 34% year-over-year increase compared to the same period in 2024.

In 2025, ransomware events against critical industries increased by 34% compared to the previous year.

Ransomware critical industries

The top five ransomware groups — Qilin, Clop, Akira, Play, and SafePay — were responsible for 938 incidents, accounting for nearly 25% of all ransomware attacks in 2025.

Ransomware Ransomware groups

In 2025, there were 103 distinct ransomware threat actors observed targeting critical infrastructure.

Ransomware Ransomware groups

Out of 103 active ransomware groups, five groups accounted for nearly 25% of global ransomware incidents.

Ransomware Ransomware groups

In 2025, 2,332 ransomware incidents targeted critical infrastructure, accounting for 50% of all incidents, compared to 1,745 incidents, which accounted for 54%, in 2024.

Ransomware Critical infrastructure

Qilin was responsible for 248 incidents, Clop for 246 incidents, Akira for 209 incidents, Play for 120 incidents, and SafePay for 115 incidents in 2025.

Ransomware Ransomware groups

From January 1 to September 1, 2025, there were 4,701 recorded ransomware incidents, with 2,332 incidents (50%) targeting critical sectors such as manufacturing, healthcare, energy, transportation, and financial services.

Ransomware critical infrastructure manufacturing

From January 1 to September 1, 2024, there were 3,219 total recorded ransomware incidents, with 1,745 incidents (54%) targeting critical sectors.

Ransomware critical infrastructure

Ransomware attacks against the manufacturing sector surged from 520 incidents in 2024 to 838 incidents in 2025, marking a 61% increase.

Ransomware manufacturing

In 2025, Italy experienced 74 ransomware incidents, representing 1.6% of all attacks.

Ransomware Italy Geography

In 2025, Germany experienced 102 ransomware incidents, representing 2.2% of all attacks.

Ransomware Germany

In 2025, 77.7% of ransomware attacks were attributed to other actors outside the top five groups.

Ransomware Ransomware groups

In 2025, the United States experienced 21.3% of all ransomware attacks, totaling approximately 1,000 incidents.

Ransomware United States

In 2025, Canada experienced 139 ransomware incidents, accounting for 3.0% of all attacks.

Ransomware Geography Canada

In 2025, five countries accounted for 1,391 ransomware events, representing nearly 30% of all recorded ransomware attacks.

Showing first 20 results

Top Categories

Ransomware groups

6

4

critical infrastructure

4

3

2

Compromised credentials

2

critical industries

Related Vendors

Cision PR Newswire

Cisco Talos Blog

Rubrik Zero Labs