The ransomware landscape has witnessed a significant transformation following the abrupt cessation of operations by multiple prominent Ransomware-as-a-Service (RaaS) groups, particularly RansomHub. This shift has allowed Qilin ransomware to emerge as a dominant threat, reportedly targeting over 600 victims since 2022. According to a report by GB Hackers, incidents of ransomware attacks published on Data Leak Sites (DLS) have declined by 6% in the second quarter of 2025 compared to the first quarter, with victim counts dropping from 2,289 to 1,607. Experts attribute this decline to global law enforcement actions, which have led to infrastructure takedowns and the exposure of ransomware affiliates. The fragmentation of the ransomware ecosystem has resulted in diminished ransom payment rates, estimated at only 25-27%, as victims increasingly rely on backup strategies and face policy restrictions against paying ransoms.
The impact of these changes is particularly evident in geographical distributions. The United States continues to be the most targeted country, comprising half of reported victims, while specific groups are focusing on other regions. For instance, Safepay has been particularly active in Germany, claiming 40% of its 76 victims, while Akira has targeted Italy, and Satanlock has affected Brazil. The healthcare sector remains vulnerable, accounting for about 8% of all ransomware victims.
In a separate but related incident, a significant breach within the Qilin ransomware operation on July 31, 2025, exposed internal credentials and operational details. This breach stemmed from a conflict between a Qilin affiliate and the group itself, leading to the public release of sensitive information about the affiliate network. The leaked credentials granted access to the Qilin affiliate management panel, revealing that the group has coordinated attacks against numerous high-profile targets, including the Palau Health Ministry and the Utsunomiya Cancer Center in Japan.
The recent turmoil within the ransomware ecosystem has also allowed groups like DragonForce to capitalize on the vacancies left by dismantled operations. As law enforcement continues to dismantle major players, remaining groups are actively recruiting their affiliates to bolster their operations. As the ransomware threat evolves, experts recommend that organizations remain vigilant and adopt robust backup and recovery strategies to mitigate potential impacts from such attacks.
