The Shifting Landscape of Ransomware: Increased Attacks, Decreased Profits

In early 2025, cybersecurity reports revealed a striking surge in ransomware attacks, reaching record-breaking levels. However, despite the uptick in attacks, ransomware groups are facing new challenges, as victims are increasingly resisting or negotiating lower payments. This shift in dynamics might signal a change in the cybercriminal landscape, with profitability starting to dwindle. The increasing frequency of attacks could indicate that cybercriminals are desperately attempting to make up for shrinking profits, while some traditional ransomware syndicates are losing their grip. This article dives into the details of the ransomware surge and the evolving tactics of cybercriminals.

the Ransomware Surge in Early 2025

Recent reports have shown a dramatic rise in ransomware attacks, especially in the first quarter of 2025. According to BlackFrog’s “State of Ransomware Q1, 2025” report, March 2025 saw over 100 publicly disclosed ransomware incidents, a significant 81% increase compared to the previous year. This contributed to a total of 278 disclosed attacks in the first quarter of 2025, marking the highest levels of activity since BlackFrog began tracking these incidents in 2020.

A noteworthy trend during this surge is the prevalence of data exfiltration. Nearly 95% of all publicly disclosed ransomware attacks involved some form of data leak, illustrating that ransomware groups are becoming more sophisticated in their methods. Additionally, BlackFrog estimates that 2,124 unreported attacks occurred during the same period, representing an alarming 113% increase from the prior year.

The healthcare sector has been particularly vulnerable to these attacks, alongside government agencies, schools, and service providers. The United States remains the top-targeted country, according to both BlackFrog and Cyble’s reports. Despite the increased frequency of ransomware incidents, there are signs that the financial impact of these attacks may be declining, as victims are increasingly resistant to paying ransoms or negotiating lower amounts.

What Undercode Says:

The surge in ransomware attacks observed in early 2025 suggests that the cybercriminal landscape is undergoing significant changes. Ransomware groups, which once thrived on high payouts, are now seeing their profits decline sharply. According to Chainalysis, the total ransom payments fell by a staggering 33% in 2024, dropping to $818 million from a record $1.25 billion in 2023. This sharp drop in profits indicates that the once lucrative nature of the ransomware industry is faltering, and cybercriminals may be adapting by shifting to new strategies.

The rise in the number of attacks, despite shrinking profits, might suggest that ransomware groups are turning to quantity over quality, attempting to make up for their reduced earnings by targeting more victims. This change in strategy could signal the beginning of a new era in ransomware activity, where the volume of attacks increases but individual payouts decrease.

Interestingly, the average ransom demand has also dropped. BlackFrog reports that the average ransom demand now stands at $663,582, a sharp contrast to the $5.2 million reported earlier in 2024 by Comparitech. This drop in ransom demands may be a result of the growing resistance among victims, who are increasingly negotiating for lower payments or refusing to pay altogether. The fact that ransomware groups are still active despite these challenges may point to a deeper issue within the criminal ecosystem—ransomware groups are under pressure to maintain their operations but are struggling to achieve the financial success they once did.

Another factor contributing to the shifting dynamics is the internal restructuring of major ransomware groups. For example, BlackBasta, which was among the most active ransomware groups in 2024, saw a significant decrease in activity in early 2025 following the leak of their internal chat. This highlights the vulnerability of even the most powerful criminal syndicates when their operational security is compromised.

Additionally, new ransomware players have emerged, with groups like Arkana Security, Secp0, and Skira Team entering the scene. These newcomers are attempting to fill the void left by the declining dominance of previous groups, but their success remains uncertain. It appears that the ransomware landscape is now more fragmented, with both established players and new entrants vying for control. The cybersecurity community will need to adapt quickly to this shifting environment, as these changes may signal new challenges ahead.

Fact Checker Results:

Increased Attacks, Decreased Payouts: The reported surge in ransomware attacks is supported by data from BlackFrog and Cyble, though the overall financial impact appears to be declining, as victims resist paying higher ransoms.
Healthcare and Government Vulnerabilities: The healthcare and government sectors have indeed been targeted frequently, corroborating the findings in the reports from both BlackFrog and Cyble.
Emerging Groups and Shifting Dynamics: The rise of new ransomware players and the decline in activity from major groups like BlackBasta align with recent trends reported by cybersecurity firms like Cyble and Rapid7.