The number of ransomware attacks worldwide grew by 126 percent in the first quarter of 2025, according to new research published by Check Point Software Technologies. The company’s "State of Ransomware Q1 2025" report highlights a sharp rise in both the sophistication and the scale of attacks, driven in part by artificial intelligence, recycled data, and fake victim lists.
Between January and March, 74 different ransomware groups publicly named 2,289 victims — the highest figure ever recorded in a single quarter.
The group Cl0p was identified as the most active, claiming 392 victims. The organisation exploited zero-day vulnerabilities in Cleon file transfer tools, and has shifted from encryption-based extortion to data leaks. Its attacks were overwhelmingly focused on North America, accounting for 83 percent of its victims.
Another key group, RansomHub, has emerged as a successor to LockBit, amassing 228 confirmed victims. The report attributes its rapid rise to generous revenue-sharing models, filling the void left by LockBit’s recent retreat.
Other actors, such as Babuk-Bjorka and FunkSec, are using false claims to increase visibility. Babuk-Bjorka reported 167 victims, while FunkSec claimed over 170. In many cases, the victims had not been hacked, or the data had already been leaked elsewhere. FunkSec has also reportedly employed AI-generated malware, which lowers technical barriers for cybercriminals and obscures the distinction between hacktivism and organised financial crime.
The report also notes a growing trend of regionally targeted campaigns. Attackers increasingly tailor their operations to local laws, infrastructure, and willingness to pay ransoms.
The United States remains the most targeted country, accounting for nearly 50 percent of global cases, partly due to a higher rate of ransom payments. In the United Kingdom, the Medusa strain accounted for 9 percent of all known attacks — five times its global average. In Germany, Safepay ransomware was responsible for 17.5 percent of all incidents, showing a clear pattern of region-specific targeting.
Despite the rise in attacks, ransom payments have fallen by 35 percent globally, according to separate figures from Chainalysis. This may be due to growing resistance among victims to pay, or the fact that some “victims” are fabricated entirely.
Instead of traditional encryption-based extortion, many groups now rely on reputational threats, using publicly available or outdated data to pressure targets. This tactic makes it harder for law enforcement and security teams to verify attacks or assess actual risk. As a result, conventional indicators such as the number of leaked cases may no longer reflect the full scale of the threat.
“The 126 percent increase in ransomware isn’t just a number — it signals a major shift,” said Sergey Shykevich, Threat Intelligence Group Manager at Check Point. “It points to smarter, faster, harder-to-trace campaigns. AI tools, fake victims and geographically tuned tactics mean that organisations must move from reactive defences to intelligence-led cyber strategies.”
Check Point’s broader Global Cyber Attack Report, also published this month, found that overall cyberattacks rose 47 percent globally during the first quarter. Organisations faced an average of 1,925 attacks per week. In Finland, the figure stood at 1,030 per week — a six percent increase compared to last year.
HT
