Rising financial damage and shifting group dominance
The FBI Internet Crime Complaint Center reported that ransomware losses reached $32.320 million in 2025, a 259% increase from the $12.473 million reported in 2024, despite the coordinated international effort to dismantle the LockBit infrastructure. GuidePoint Security data shows a 58% year-over-year increase in ransomware victims in 2025. Because the number of active threat groups grew 46% to reach 124 in 2025, Qilin emerged as the most active group, surpassing the previous leader, LockBit. You already know that dismantling one group often leads to fragmentation. Can law enforcement keep pace with this rapid group evolution? In 2025, the IC3 received 3,611 ransomware reports, an upward trend from 3,156 in 2024 and 2,825 in 2023. The IC3 also identified 63 new ransomware variants in 2025, an average of 5.25 new variants per month. Total cybercrime losses reached $16.6 billion in 2024, a 33% increase over 2023. Phishing and spoofing led with 193,407 complaints in 2024, followed by extortion with 86,415 and personal data breaches with 64,882. Cyber-enabled fraud accounted for 83% of total losses in 2024, while BEC complaints in 2025 climbed to 24,768.
Tactics of successors and the reality of encryption
Criminals adapt after high-profile takedowns. ALPHV Blackcat went dark following a $22 million ransom payment from Optum. LockBit 4.0, also called LockBit Neo, surged in early 2026 and targets unpatched infrastructure like VMware ESXi. In January 2026, LockBit 4.0 encrypted 90% of file servers at a manufacturing firm in under 45 minutes and stole 2TB of HR and financial data. Affiliates of groups like ALPHV Blackcat use social engineering, such as posing as IT staff via phone or SMS, to steal credentials. They deploy remote access software like AnyDesk, Mega sync, and Splashtop to prepare for data theft. By using the adversary-in-the-middle framework Evilginx2, affiliates obtain multifactor authentication credentials and session cookies. Law enforcement disrupted LockBit through Operation Cronos, which seized websites and servers and obtained over 1,000 decryption keys. The US Department of Justice indicted five Russian nationals, including Artur Sungatov and Ivan Kondratyev. Kondratyev faces additional charges in California for using REvil ransomware in 2020. The US State Department offered a $10 million reward for information leading to the arrest of Mikhail Pavlovich Matveev. ALPHV affiliates use "unsolicited cyber remediation advice" as an incentive for payment.
| Ransomware Group | 2024 Status/Note |
|---|---|
| Akira | Top ransomware actor |
| LockBit | Top ransomware actor |
| RansomHub | Top ransomware actor |
| Fog | New variant |
| Lynx | New variant |
Critical infrastructure remains the target
Ransomware remains the most pervasive threat to critical infrastructure. In 2025, 55% of ransomware victims were in the United States. Because threat actors target industries with low downtime tolerance, such as healthcare and manufacturing, they force faster payments. Manufacturing accounted for 14% of attacks, whereas the technology sector accounted for 9% and retail/wholesale accounted for 7%. In 2025, ransomware victims hit an all-time high with 2,287 victims in Q4 alone. December 2025 saw 814 successful attacks, a 42% increase over the previous year. This growth follows a rise in illicit cryptocurrency volume to $158 billion in 2025. Such volume reflects intensified sanctions and improved attribution of activity linked to already-sanctioned actors through the use of advanced monitoring.
