Extortion and Ransomware Trends January-March 2025
Contents
Executive Summary
Unit 42 regularly monitors the cyberthreat landscape, including trends in extortion and ransomware. Ransomware actors continue to evolve to increase the effectiveness of their attacks and the likelihood that organizations will pay what is demanded. In our 2025 Unit 42 Global Incident Response Report, we found that 86% of incidents involved business disruption, spanning operational downtime, reputational damage or both.
In this survey of recent trends, we share qualitative observations based on incident response cases and the broader threat landscape. These include:
- Threat actors claiming compromises that can’t be substantiated
- Nation-state actors working with ransomware actors
- Use of tools to disable endpoint security sensors
- Attacks on more types of systems, including cloud
- Insider threats leading to extortion
We also share insights about public reports of ransomware compromises posted on threat actors’ leak sites. This includes:
- The most active ransomware leak sites
- Activity by month
- Activity by country
- Industries most affected by …
Unit 42 regularly monitors the cyberthreat landscape, including trends in extortion and ransomware. Ransomware actors continue to evolve to increase the effectiveness of their attacks and the likelihood that organizations will pay what is demanded. In our 2025 Unit 42 Global Incident Response Report, we found that 86% of incidents involved business disruption, spanning operational downtime, reputational damage or both.
In this survey of recent trends, we share qualitative observations based on incident response cases and the broader threat landscape. These include:
- Threat actors claiming compromises that can’t be substantiated
- Nation-state actors working with ransomware actors
- Use of tools to disable endpoint security sensors
- Attacks on more types of systems, including cloud
- Insider threats leading to extortion
We also share insights about public reports of ransomware compromises posted on threat actors’ leak sites. This includes:
- The most active ransomware leak sites
- Activity by month
- Activity by country
- Industries most affected by …