Ransomware threats are rising fast in 2025, with the first half of the year already showing a sharp increase in attacks. New research shows that U.S.-based companies, small and medium-sized businesses, and firms in the manufacturing sector are currently among the top targets for these cybercriminal campaigns.
Between January and June this year, nearly 4,200 ransomware incidents were made public on the dark web. That’s a 49% jump compared to the same time period in 2024, according to recent findings by cybersecurity firm NordStellar.
Experts suggest that several factors may be driving this rise. These include the growing use of Ransomware-as-a-Service (RaaS) — a model where criminal groups rent out ransomware tools to others, as well as challenges related to remote or hybrid working setups. Additionally, ongoing economic struggles may be pushing more individuals toward illegal activities, including cybercrime.
In terms of geography, the United States experienced the highest number of attacks, with 596 cases. This accounted for nearly half of all reported incidents worldwide. Other affected countries included Germany (84 cases), Canada (74), the UK (40), and Spain (37). Analysts believe that U.S. companies are often targeted because of their size, visibility, and the potential financial damage of a public attack. These businesses are more likely to pay the ransom quickly to avoid reputational harm.
Tight regulations around data privacy and system availability may also push organizations to resolve incidents faster, especially if they fear penalties or losing client trust.
The manufacturing sector was hit particularly hard, with 223 reported cases. Construction (97 incidents) and the IT industry (88) followed close behind. Experts point out that many of these organizations rely on older systems that lack regular updates, and they often operate in multiple locations, making cybersecurity harder to manage across the board.
Small to mid-sized firms, especially those with 51 to 200 employees and annual revenue between $5 million and $25 million, faced the most ransomware attempts. Researchers say this may be because these companies often depend on third-party IT providers and don’t always have strong internal security policies.
As for which ransomware gangs are most active in 2025, the group known as Qilin leads with 214 reported attacks. SafePay, allegedly linked to a recent incident involving a global tech distributor, followed with 201 cases, and Akira came in third with 200.
Cybersecurity professionals continue to emphasize basic but crucial practices: employee training on phishing threats, use of multi-factor authentication, and better password protection. Beyond that, building a full-scale cybersecurity plan is key to identifying and stopping threats early, before they cause widespread damage.
