Loading story…
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by BleepingComputer puts the 2025 victim payment rate at 28% (down from 62.8% in 2024 and 78.9% in 2022) while noting a roughly 50% year-over-year increase in claimed attacks; on-chain ransomware payments for 2025 were estimated at $820M with the expectation the total could approach or exceed $900M as additional attributions are made. Despite lower overall payment participation, the median ransom payment increased sharply (reported as up 368%, from $12,738 in 2024 to $59,556 in 2025), alongside greater ecosystem fragmentation (Chainalysis observed 85 active extortion groups), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics.
Separately, the UAE Cyber Security Council said it thwarted an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of AI-enabled tooling to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including Medusa’s claimed breach of SimonMed Imaging (reported ~1.2M patients affected; $1M demand to delete data) and a ransomware-enabled breach of UK defense contractor Dodd Group attributed to Lynx (reported ~4TB stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Chainalysis said the share of ransomware victims paying extortion demands dropped to 28% in 2025, the lowest level on record, even as claimed attacks rose significantly. The firm estimated on-chain ransomware payments reached $820 million in 2025 and could ultimately approach or exceed $900 million as more incidents are attributed.
The UAE Cyber Security Council said it stopped an organized ransomware attack over the weekend that targeted the country's digital infrastructure and essential services across vital sectors. Officials said the activity included network infiltration, ransomware deployment, and phishing campaigns, and claimed the attackers used AI-enabled tools.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csis.org
Open sourcebleepingcomputer.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Chainalysis’ 2026 Crypto Crime Report** assessed the 2025 ransomware economy and found that **on-chain ransomware payments fell ~8% year-over-year to about $820M**, even as **claimed attacks increased ~50%**. The report also observed a sharp rise in the **median ransom payment** (to roughly **$60K**, up several-fold from 2024), suggesting attackers are concentrating on larger, higher-value victims even as fewer victims pay overall. Chainalysis highlighted **Initial Access Broker (IAB)** activity as a potential leading indicator, noting that spikes in IAB-related inflows often **precede increases in ransomware payments and victim leak activity by ~30 days**, and it described increasing convergence in the “enablement” layer (e.g., shared use of **bulletproof hosting** and **residential proxy** services) across financially motivated and state-linked actors. Recorded Future News’ *The Record* reported additional metrics from the same Chainalysis analysis, including that the **victim payment rate dropped to a record low (~28%)** and that the $820M figure may rise toward **~$900M** as attribution improves (mirroring how 2024 totals increased after initial reporting). The article attributed the divergence between rising incident volume and falling payments to improved incident response, increased regulatory scrutiny discouraging payments, and law-enforcement disruption that has fragmented major ransomware operations into smaller groups—some using poorly designed malware that can be addressed with decryptors. Other items provided (a UAE claim of thwarting a “terrorist” ransomware campaign and a CSIS incident timeline covering multiple unrelated 2025 events) are not part of the Chainalysis 2025 ransomware-payment findings and do not materially corroborate that specific report’s conclusions.
Jun 29, 2026
The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) released a comprehensive report analyzing ransomware activity and payments from January 2022 to December 2024. The report revealed that over this three-year period, organizations reported 4,194 ransomware incidents and paid more than $2.1 billion in ransoms, nearly matching the $2.4 billion paid over the previous nine years. Ransomware payments peaked in 2023 at approximately $1.1 billion, followed by a significant decline to $734 million in 2024, a drop attributed to major law enforcement actions against prominent ransomware groups such as ALPHV/BlackCat and LockBit. Despite the decrease in payments, the number of reported incidents only slightly declined, indicating that while attacks remain frequent, fewer victims are paying ransoms. The report highlighted that the manufacturing, financial services, and healthcare sectors were the most targeted, with financial institutions suffering the largest monetary losses. The vast majority of ransom payments (about 97%) were made in Bitcoin, and most funds were laundered through unregulated cryptocurrency exchanges. The median ransom payment peaked at $174,000 in 2023 before dropping to $155,257 in 2024. The data underscores the evolving nature of the ransomware threat landscape and suggests that coordinated law enforcement efforts can have a measurable impact on the financial incentives driving ransomware operations.
Jun 29, 2026
Ransomware activity surged in 2025 despite significant law enforcement actions against major ransomware-as-a-service (RaaS) groups, with new groups quickly filling the void and victim numbers reaching record highs. Data from RansomLook.io and Ransomware.live showed a sharp increase in claimed ransomware victims, with global numbers rising from approximately 5,400 in 2023 to over 8,000 in 2025. Attackers increasingly relied on social engineering rather than technical exploits, and the impact of ransomware was felt across all sectors, including retail, education, government, and healthcare. Notable incidents included coordinated campaigns against major UK retailers and disruptive attacks on organizations such as Coupang, University of Phoenix, and the NHS’s technology provider DXC Technology. The year’s most significant attacks demonstrated the systemic and cross-sector nature of modern cyber risk, with attackers exploiting third-party dependencies and identity weaknesses to maximize disruption. High-profile breaches led to operational outages, data exposure, and substantial financial and reputational damage, as seen in the case of Marks & Spencer, which suffered a dramatic drop in profits following a ransomware campaign attributed to the Scattered Spider group. These incidents have prompted organizations to reassess their incident response strategies, invest in ransomware readiness, and strengthen supply chain security as they prepare for evolving threats in 2026.
Jun 29, 2026