Report
Ransomware Wrap-Up — Q3 2025
ZeroFox Intelligence Assessment
Track ransomware collectives, review targeted industries, and see operational trends across regions. Help inform your team’s threat models, validate risk assumptions, and benchmark against global activity.
Download the Report
Stay Ahead of Ransomware Threats
The ransomware ecosystem remains highly concentrated with five collectives accounting for nearly half of all global activity this quarter.
Details Inside the Report:
- Global incident volume: 1,429 R&DE events in Q3 2025—up 5% from Q2, continuing a multi-year upward trend.
- Regional targeting: North America accounted for 59% of all observed incidents.
- Industry impact: Manufacturing, professional services, construction, healthcare, and retail represented 55% of total attacks.
- Rising threat groups: Qilin, Akira, INC Ransom, Play, and SafePay were responsible for nearly half of all global R&DE activity.
- Emerging risk: Professional services firms saw a 10.4% year-over-year increase in attacks—on pace for a 47% rise by year-end.
©2026 by ZeroFox. All Rights Reserved.
Privacy PolicySecurity Trust CenterTerms and TransparencyMy Privacy Choices