01Threat Actor Distribution
- Akira fell from 83 to 49 listings and NightSpire from 36 to 18.
- Play dropped from 46 listings to 4, while Coinbase Cartel rose from 25 to 41.
- Activity was less concentrated: 19 groups are listed individually in the table, compared with 16 in March. Krybit (21) and Lamashtu (17) were first observed in our dataset.
02Geographic Distribution
- US listings fell from 416 to 307, accounting for most of the month's overall decline, while the number of represented countries rose from 71 to 78.
- Victims outside the United States totalled 429, compared with 446 in March.
- France fell back from 44 to 24 victims after doubling in March.
03Industry Distribution
- Professional, Scientific, and Technical Services fell from 168 to 121 victims, the steepest drop among industries.
- Manufacturing remained first with 168 victims, down from 195; Qilin (25) and DragonForce (24) were its largest contributors.
- Health Care and Social Assistance rose from 40 to 51 victims and moved into third place.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (48 of 307 victims).
- Qilin listed the most victims in Germany (8 of 34 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- Qilin listed the most victims in Manufacturing (25 of 168 victims).
- Qilin listed the most victims in Professional, Scientific, and Technical Services (21 of 121 victims).
06Six Month Trend Context
April reversed most of March's increase: listings fell back to 736 after reaching 862, returning to the 717–813 range recorded between November and February.
07Security Findings
- Misconfiguration70.0%
MX and DNS misconfiguration that may enable spoofing or phishing
505 of 721 - Software Vulnerability57.1%
Out-of-date services/products with potentially highly exploitable vulnerabilities
412 of 721 - Critical Exposed Network Services54.0%
Open RDP or SMB ports publicly visible
389 of 721 - Fraudulent Domains52.0%
At least one possible phishing domain
375 of 721 - Stealer Logs48.5%
At least one record found in stealer logs
350 of 721 - Botnet Activity33.3%
At least one IP address involved in botnet, malware propagation or spam propagation
240 of 721 - Credential Stuffing20.5%
At least one credential leaked in the last 90 days
148 of 721
Misconfiguration (70.0%) and Software Vulnerability (57.1%) were the most common findings among scanned victims, and Credential Stuffing the least common (20.5%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- Listings fell 14.6% to 736, yet the number of active named groups rose from 58 to 64.
- US listings fell from 416 to 307, accounting for most of the overall decline.
- Play dropped from 46 listings to 4.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.