Ransomware Attacks Surge in 2025 Despite Law Enforcement Crackdowns Ransomware attacks continued to escalate in 2025, defying expectations of a decline as cybercriminal operations grew more fragmented and resilient. According to Emsisoft’s 2025 State of Ransomware in the US report, over 8,000 victims were publicly named on ransomware extortion sites—a 50% increase from 2023—though the true number of attacks is likely higher, as many organizations pay ransoms or recover quietly without appearing on leak sites. The ransomware landscape has shifted from a few dominant groups to a sprawling ecosystem of over 100 active crews by the end of 2025. While law enforcement scored high-profile wins, such as the August takedown of BlackSuit, these disruptions have had limited impact. Operators and affiliates often rebrand or join new groups, ensuring continuity despite infrastructure seizures. A handful of gangs—including Qilin, Akira, Cl0p, and Play—remained the most prolific, though Emsisoft cautions that victim counts may reflect aggressive self-promotion rather than actual attack volume. Meanwhile, initial access tactics have evolved: while vulnerabilities and exposed services remain a factor, attackers increasingly rely on phishing, stolen credentials, and social engineering to bypass perimeter defenses. Groups like Scattered Spider and Lapsus$ Hunters exemplify this shift, favoring direct infiltration over technical exploits. Emsisoft analyst Luke Connolly attributes the persistence of ransomware to the fluid movement of affiliates and the enduring effectiveness of social engineering. With no shortage of skilled operatives and proven attack methods, the report suggests victim counts are likely to keep rising.