InfoSecBulletin Cybersecurity for mankind
Ransomware attacks dropped by 43% worldwide in Q2 2025 from Q1, largely due to law enforcement efforts and internal conflicts, reports NCC Group. A total of 1180 attacks were recorded from April to June, which compares to 2074 attacks in Q1.
Ransomware attacks decreased for the fourth month in a row in June 2025, dropping 6% from May to 371. Q2 saw a slowdown after a spike in attacks in the first quarter, mainly due to aggressive campaigns by major groups like Clop, RansomHub, and Akira.
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Recent law enforcement actions have disrupted major ransomware operators, specifically targeting Clop and RansomHub affiliates. As a result, Clop and RansomHub are no longer among the top 10 active ransomware groups in Q2.
“These disruptions likely caused a ripple effect across the ransomware group’s ecosystem, forcing affiliates to regroup or shift to emerging ransomware groups,” NCC Group researchers noted.
The July 23 report noted that internal leaks and conflicts among ransomware groups may have contributed to the slowdown.
In May, insider information from the notorious LockBit group was leaked.
Meanwhile, researchers have observed DragonForce fighting a “turf war” with rival ransomware operators as it seeks to assert its dominance in the cybercrime marketplace.
DragonForce likely caused RansomHub’s infrastructure outage in late March 2025, disrupting operations.
The decline in attacks may also be linked to seasonal slowdowns in Q2 from global holidays like Easter and Ramadan.
Qilin Leads the Way in Fragmented Market:
Qilin was the most active ransomware group in Q2, with 151 attacks, accounting for 13% of the total. This increased from 95 attacks in Q1.
In second place was Akira with 131 attacks, followed by Play (115) and SafePay (108).
SafePay gained attention in May for reporting 70 attacks. It was first spotted in September 2024, and researchers found little public information on the group.
Experts have connected SafePay to notable groups like LockBit, BlackCat, INC Ransom, and Play.
NCC Group reported tracking 86 active attack groups in 2025 so far, likely exceeding 2024’s record.
“The increased number of attackers means a broader range of attack methods that businesses need to be prepared for,” commented Matt Hull, global head of threat intelligence, NCC Group.
In Q2, the industrial sector experienced the most attacks, totaling 353, which is 30% of all attacks.
Consumer discretionary ranked second with 251 attacks, accounting for 21% of the total, heavily impacting retail in Q2. Information technology, healthcare, and financial services followed, making up the top five targeted industries with 10%, 8%, and 6% respectively.
