Despite a year-over-year and quarter-over-quarter increase in active ransomware operations, organizations claimed to have been compromised by ransomware gangs have dropped by 22.9% between the first and second quarter of 2025, reports CRN.
Such a quarter-over-quarter decline is the highest since tracking began, according to an analysis from the GuidePoint Research and Intelligence Team. However, the relatively new SafePay ransomware group, which recently targeted Ingram Micro, was noted to be on a tear, having claimed 111 attacks during the second quarter as it increased its monthly targeting from between three and 10 in September 2024 to between 30 and 40 recently. Additional findings revealed that law enforcement efforts have not been completely effective in eradicating ransomware gangs. "We've assessed that in some of these cases, we're likely seeing splintering and new groups forming from that disruption which would explain the uptick in new, distinct, named ransomware groups," said GuidePoint threat intelligence consultant Jason Baker.
Such a quarter-over-quarter decline is the highest since tracking began, according to an analysis from the GuidePoint Research and Intelligence Team. However, the relatively new SafePay ransomware group, which recently targeted Ingram Micro, was noted to be on a tear, having claimed 111 attacks during the second quarter as it increased its monthly targeting from between three and 10 in September 2024 to between 30 and 40 recently. Additional findings revealed that law enforcement efforts have not been completely effective in eradicating ransomware gangs. "We've assessed that in some of these cases, we're likely seeing splintering and new groups forming from that disruption which would explain the uptick in new, distinct, named ransomware groups," said GuidePoint threat intelligence consultant Jason Baker.
