State of Ransomware: September 2025
Published 1 October 2025 · ThreatVectr Intelligence
Ransomware groups claimed 545 attacks on organisations worldwide in September 2025, up 4% on the previous month's 526. 60 distinct groups posted at least one victim during the month, across 62 countries. The busiest single day was 4 September, with 32 victims listed.
Qilin was the most active operation of the month, claiming 80 victims — 15% of all listings. Akira (78) and INC Ransom (37) followed. 7 groups appeared for the first time, including Blackshrantac, MedusaLocker, Alphalocker, Ciphbit.
Manufacturing bore the heaviest targeting, with 79 claimed victims, ahead of Financial Services (66) and Technology (66). By geography, United States accounted for 277 claims — 51% of the month — with Canada (24) and Germany (23) next.
Claims per day — September 2025
Most active groups
- 1Qilin·8015%
- 2Akira·7814%
- 3INC Ransom1377%
- 4Play1367%
- 5KillSec34326%
- 6Lynx9255%
- 7The Gentlemen15183%
- 8Devman10143%
- 9Coinbasecartel26112%
- 10Warlock2112%
First seen this month:Blackshrantac, MedusaLocker, Alphalocker, Ciphbit, Daixin, Yurei, Lunalock
Most-targeted sectors
- 1Manufacturing79
- 2Financial Services66
- 3Technology66
- 4Construction51
- 5Business Services48
- 6Healthcare36
- 7Consumer Services34
- 8Agriculture and Food Production21
- 9Education21
- 10Hospitality and Tourism15
Most-affected countries
- 1United States277
- 2Canada24
- 3Germany23
- 4South Korea18
- 5Italy13
- 6France12
- 7United Kingdom12
- 8India10
- 9Spain7
- 10Australia6
Every figure in this report counts a claim posted to a criminal leak site, observed via the monitoring service ransomware.live. A listing is an extortion tactic, not a confirmed breach: some claims are exaggerated, some are duplicates under new branding, and a few are outright false. Companies named in listings have not necessarily confirmed any incident, and ThreatVectr does not publish victim names from this dataset.
Cite this report
This report is free to cite and reproduce with attribution. Suggested citation:
ThreatVectr, “State of Ransomware: September 2025”, https://threatvectr.com/ransomware-tracker/reports/september-2025
Journalists and researchers: for questions about the data or methodology, contact the newsdesk.
Most ransomware starts with one email
The groups in this report overwhelmingly get in through phishing. Train2Secure runs realistic phishing simulations and short training that teach your team to spot the lure.