Ransomware victim numbers hit a new all-time high last year with 2,287 ransomware victims posted in Q4 2025 alone. At the same time the number of threat groups has reached record levels. 124 distinct ransomware groups were active in 2025, the highest ever recorded and a 46 percent year-on-year increase.
These are among the findings of a new report from GuidePoint Security which also shows the US remains a favored target, in 2025, more than half (55 percent) of ransomware victims were based in the US.
“The GRIT 2026 Ransomware and Cyber Threat Report shows the most active year for ransomware we’ve ever recorded, revealing a 58 percent year-over-year increase in ransomware victims,” says Jason Baker, lead threat analyst at GuidePoint Security. “While law enforcement disruptions have reshaped the Ransomware-as-a-Service (RaaS) ecosystem, group fragmentation is driving new patterns of high-volume, repeatable operations, pushing overall activity to record-breaking levels. The rise of Qilin as the most active group we’ve ever tracked — surpassing even LockBit at its peak — underscores how the ecosystem is evolving. For organizations, well-resourced defenders, proactive vulnerability management and real-time threat intelligence will be critical for mitigating risk in the year ahead.”
The report also explores the growing use of AI in ransomware attacks, examines the impact of zero-day vulnerabilities on ransomware and takes an in-depth look at major ransomware operators throughout the year, including an analysis of ransomware payments made to the Qilin and Akira groups.
“International law enforcement operations throughout 2025 applied sustained pressure across the ransomware ecosystem, disrupting core services that many groups rely on to operate,” Baker adds. “While threat actors continue to adapt, these coordinated actions are raising the cost of doing business for ransomware operators and reinforcing the importance of collective, cross-border efforts in shaping a more resilient security landscape.”
You can get the full report from the GuidePoint site. There will also be a webinar to present the findings on January 22nd at 2:00pm EST.
Image credit: Benjawan Sittidech/Dreamstime.com
