Report by GuidePoint Security
GRIT Q2 2025 Ransomware & Cyber Threat Report
Key Findings
There was a 23% decline in publicly reported ransomware incidents in Q2 2025, which may indicate changing attacker patterns beyond seasonal norms.
Qilin saw an 85% increase in activity, making it the most active threat group in Q2 2025.
The healthcare sector dropped out of the top five most targeted industries by ransomware for the first time since Q2 2022.
Ransomware victim numbers remain elevated year-over-year (+43%).
The number of active ransomware groups climbed from 45 in Q2 2024 to 71 in Q2 2025.
There has been a 45% year-over-year rise in active ransomware groups.
52% of observed ransomware victims in Q2 2025 were based in The United States.
23% of observed ransomware victims in Q2 2025 were based in Singapore.
5% of observed ransomware victims in Q2 2025 were based in Canada.