01Threat Actor Distribution
- Qilin (61 to 83) and Akira (39 to 59) both grew and together accounted for 27.9% of all listings.
- Sinobi rose from 4 to 27 listings, 25 of them in the United States, and WarLock posted 24 after none in July.
- INC Ransom moved against the overall increase, falling from 56 to 24 listings.
02Geographic Distribution
- The US share of victims rose from 49.4% to 52.7%, as US victims increased from 233 to 268.
- Germany ranked second with 30 victims, up from 19; DragonForce (8) and SafePay (7) listed the most.
- Qilin (45), Akira (35) and Sinobi (25) were the largest contributors to US listings.
03Industry Distribution
- Manufacturing overtook Professional, Scientific, and Technical Services as the most affected industry, with 109 victims against 97.
- Qilin listed 22 Manufacturing victims, more than any other group.
- Retail Trade (from 23 to 11) and Public Administration (from 19 to 7) recorded the largest industry declines.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
Qilin
Akira
DragonForce
SafePay
Sinobi
Play
INC Ransom
WarLock
Pear
Cephalus
Others
USA
45
35
11
11
25
22
11
10
14
11
73
Germany
5
3
8
7
1
6
UK
2
1
3
1
1
2
12
Canada
2
3
4
2
2
6
Italy
3
1
1
1
9
Australia
1
1
1
1
5
France
1
1
1
1
4
Japan
2
1
1
3
Spain
4
1
2
Brazil
1
5
Others
19
17
7
2
1
1
8
11
2
2
48
Grand Total
83
59
31
29
27
25
24
24
18
16
173
- Qilin (45), Akira (35) and Sinobi (25) were the largest contributors to US listings.
- Germany ranked second with 30 victims; DragonForce (8) and SafePay (7) listed the most there.
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
Qilin
Akira
DragonForce
SafePay
Sinobi
Play
INC Ransom
WarLock
Pear
Cephalus
Others
Manufacturing
22
12
4
6
9
7
8
4
1
2
34
Professional, Scientific, and Technical Services
9
14
7
5
6
3
7
7
8
31
Construction
11
6
3
2
3
1
1
3
4
Health Care and Social Assistance
4
1
2
3
3
4
14
Wholesale Trade
5
4
1
4
2
11
Finance and Insurance
4
1
1
2
4
1
13
Educational Services
7
3
1
2
11
Administrative and Support and Waste Management and Remediation Services
2
2
1
1
1
1
1
1
9
Other Services (except Public Administration)
5
5
1
2
5
Transportation and Warehousing
3
2
3
1
1
6
Others
11
18
13
6
3
6
1
10
4
1
35
Grand Total
83
59
31
29
27
25
24
24
18
16
173
- Qilin listed 22 Manufacturing victims, more than any other group in that industry.
- Akira listed the most victims in Professional, Scientific, and Technical Services (14), followed by Cephalus (8).
06Six Month Trend Context
After falling from 600 in March to 441 in April, monthly listings stayed between 441 and 472 through July. August's 509 was the highest total since March.
07Key Takeaways
- Listings rose 7.8% to 509, the highest monthly total since March 2025.
- INC Ransom’s listings fell by more than half, from 56 to 24, while Sinobi rose from 4 to 27.
- Manufacturing (109 victims) overtook Professional, Scientific, and Technical Services (97) as the most affected industry.
08Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.