✅ Report Title: 2025 H2 Ransomware Trends Report

S2W Threat Intelligence Center, TALON, has published a detailed analysis report on ransomware group activity in the second half of 2025.

✅ Executive Summary:

- This report analyzes the activities of ransomware groups that occurred in the second half of 2025 (from July 1, 2025 to December 31, 2025).

- The subjects of analysis are ransomware groups that operate ransomware leak sites and the victim organizations and companies whose data were uploaded to those leak sites.

- In the second half of 2024, ransomware infections of 3,988 organizations were posted on ransomware leak sites.

  - Compared to the second half of 2024 (from July 1, 2023 to December 31, 2023), the total number of victim organizations increased by 1,144.

📌 Ransomware Group Activity

- A total of 109 ransomware groups were active in the second half of 2025, with each group attacking an average of approximately 37 organizations.

- In the second half of 2025, a total of 51 new ransomware groups emerged. The highest number of new groups appeared in September, with 12 groups introduced during that month.

📌 Ransomware Victims

- In the second half of 2025, large companies accounted for 5.8% of the organizations attacked by ransomware groups, which is an increase compared to 3.8% in the first half of this year.

- The TOP 10 countries affected by ransomware in the second half of 2025 were selected, with the United States being the most impacted country.

  - Compared to 2024, the United States had the largest increase in ransomware victims in the first half of 2025, while Belgium experienced the greatest decrease.

- The TOP 10 industries affected by ransomware in the second half of 2025 were identified. During this period, the Manufacturing Industry suffered the greatest impact.

📌 Risk Assessment

- As a result of the S2W Threat Intelligence Center's independent risk assessment of ransomware groups, PLAY, Nova, Interlock, INC, and The Gentlemen were selected as the Top 5 high-risk ransomware groups for the second half of 2025.

🧑‍💻 Author: S2W TALON

👉 Read the full report: https://bit.ly/40XBzrS

📄 View the 2025 H1 Ransomware Report: https://bit.ly/4urW5P2

*The full report is available upon request or with a subscription to the S2W platform.