BlackFog recently shared findings from its analysis of global ransomware activity from July to September 2025. The findings show that publicly disclosed attacks continued to set new records, with a 36% increase compared to the same quarter last year. These numbers also represents a 335% increase since Q3 2020, underscoring the continued rise in ransomware attacks over the last five years.
Furthermore, when monthly totals were compared to previous years, BlackFog found:
- A 50% spike in July.
- A 37% increase in August.
- And a 27% uptick in September.
Similar to the second quarter report, the ransomware gang Qilin was the most active, although it's worth noting that approximately 40% of reported attacks have not been attributed to any known ransomware group yet. The quarter also saw the emergence of 18 new ransomware groups, several linked to high-profile incidents targeting large organizations. Among these, the newcomer DEVMAN made a significant impact.
When looking at attacks that are not disclosed publicly, the manufacturing sector was hit hardest, accounting for 22% of all incidents. In Q3 nearly 85% of all ransomware attacks went unreported, representing a 21% increase over the same period last year.
Data theft remains the dominant tactic used by attackers, with 96% of all disclosed cases involving data exfiltration, marking the highest level recorded to date.
Commenting on the findings, Dr. Darren Williams, Founder and CEO of BlackFog, said: “From grounded aircraft and stranded passengers to manufacturers forced to halt production, the disruption has been significant. Operations at Jaguar Land Rover, for instance, only recently resumed following the August incident, while numerous smaller suppliers are still counting the cost.
"As ransomware volumes show a continued upward trend, the best option for organizations is to make it as hard as possible for cybercriminals to take advantage of them. That means protecting data so that they have no leverage for extortion and, critically, no incentive to return.”
BlackFog’s State of Ransomware report for July–September 2025 can be accessed here.
