While I’m on a report kick, this cybersecurity research report is a month old (I’ve been busy and traveling). Most of the news I receive from security firms concerns research reports. If you’re not already aware that many threats are in the wild threatening your operations, then really there isn’t a lot of we can do for you.

This report from GuidePoint Security reveals a 45% year-over-year rise in active ransomware groups. The company has released its quarterly Ransomware & Cyber Threat Report from the GuidePoint Research and Intelligence Team (GRIT).

Covering the second quarter of 2025, the new GRIT Q2 2025 Ransomware & Cyber Threat Report offers exclusive in-depth analysis of the evolving Ransomware as a Service (RaaS) ecosystem, threat actor behaviors and emerging cybercrime trends—including a 45% year-over-year increase in the number of active ransomware groups. 

The Q2 2025 Ransomware & Cyber Threat Report also investigates Iranian cyber threat activity, the growing momentum of the RaaS group DragonForce and law enforcement’s impact on Lumma Stealer, a prolific information-stealing malware favored by cyber criminals. 

Key findings include:

• A 45% year-over-year increase in active ransomware groups, climbing from 45 in Q2 2024 to 71 in Q2 2025. 
• Ransomware victim numbers remain elevated year-over-year (+43%), but a 23% decline in Q2 2025 hints at changing attacker patterns beyond seasonal norms.
• An 85% increase in activity from Qilin, the most active threat group of this quarter.
• 52% of observed ransomware victims in Q2 2025 were based in The United States, followed by Singapore (23%) and Canada (5%).  
• The manufacturing, technology and legal industries were most heavily impacted by ransomware. Notably, the healthcare sector dropped out of the top five most targeted industries for the first time since Q2 2022.

The Ransomware & Cyber Threat Report is based on data obtained from publicly available resources, including threat groups themselves, as well as threat analyst insights into the ransomware threat landscape.