ZeroFox Intelligence Assessment


Track ransomware collectives, review targeted industries, and see operational trends across regions. Help inform your team’s threat models, validate risk assumptions, and benchmark against global activity.

core/heading

<h3 class="wp-block-heading" id="h-stay-ahead-of-ransomware-threats">Stay Ahead of Ransomware Threats</h3>

The ransomware ecosystem remains highly concentrated with five collectives accounting for nearly half of all global activity this quarter.

core/paragraph

The ransomware ecosystem remains highly concentrated with five collectives accounting for nearly half of all global activity this quarter.

Details Inside the Report:

Details Inside the Report:

<ul class="wp-block-list">
<li>Global incident volume: 1,429 R&amp;DE events in Q3 2025—up 5% from Q2, continuing a multi-year upward trend.</li>



<li>Regional targeting: North America accounted for 59% of all observed incidents.</li>



<li>Industry impact: Manufacturing, professional services, construction, healthcare, and retail represented 55% of total attacks.</li>



<li>Rising threat groups: Qilin, Akira, INC Ransom, Play, and SafePay were responsible for nearly half of all global R&amp;DE activity.</li>



<li>Emerging risk: Professional services firms saw a 10.4% year-over-year increase in attacks—on pace for a 47% rise by year-end.</li>
</ul>

Global incident volume: 1,429 R&amp;DE events in Q3 2025—up 5% from Q2, continuing a multi-year upward trend.

core/list-item

<li>Global incident volume: 1,429 R&amp;DE events in Q3 2025—up 5% from Q2, continuing a multi-year upward trend.</li>

Regional targeting: North America accounted for 59% of all observed incidents.

<li>Regional targeting: North America accounted for 59% of all observed incidents.</li>

Industry impact: Manufacturing, professional services, construction, healthcare, and retail represented 55% of total attacks.

<li>Industry impact: Manufacturing, professional services, construction, healthcare, and retail represented 55% of total attacks.</li>

Rising threat groups: Qilin, Akira, INC Ransom, Play, and SafePay were responsible for nearly half of all global R&amp;DE activity.

<li>Rising threat groups: Qilin, Akira, INC Ransom, Play, and SafePay were responsible for nearly half of all global R&amp;DE activity.</li>

Emerging risk: Professional services firms saw a 10.4% year-over-year increase in attacks—on pace for a 47% rise by year-end.

<li>Emerging risk: Professional services firms saw a 10.4% year-over-year increase in attacks—on pace for a 47% rise by year-end.</li>

Ransomware Wrap-Up — Q3 2025

ZeroFox Intelligence Assessment

Download the Report

Stay Ahead of Ransomware Threats