01Threat Actor Distribution
- Activity was less concentrated: 27 groups are listed individually in the table, compared with 22 in July.
- Several groups posted large counts after little or no activity in July: Orova (45) and Storm (40) were first observed in our dataset, Dire Wolf posted 43 after none in July, and Clop rose from 1 to 45.
- Of the 79 named groups active this month, 29 had no listings in July.
02Geographic Distribution
- Italy tripled from 17 to 51 victims and became the third most represented country; Qilin and The Gentlemen listed 11 each, and TITAN 9.
- Storm, first observed in our dataset this month, listed 27 US victims, the third-highest US count after Qilin (55) and The Gentlemen (35).
- Victims were recorded in 79 countries, down from 82 in July, even as total listings rose.
03Industry Distribution
- Manufacturing rose from 199 to 233 victims, although its share eased from 23.1% to 21.9%; Qilin (33), The Gentlemen (22) and Clop (21) listed the most.
- Information nearly doubled from 37 to 68 victims; Qilin (15) and Dire Wolf (11) listed the most.
- Finance and Insurance (42 to 63) and Retail Trade (27 to 48) also rose.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (55 of 448 victims).
- Qilin listed the most victims in Germany (12 of 53 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- Qilin listed the most victims in Manufacturing (33 of 233 victims).
- Qilin listed the most victims in Professional, Scientific, and Technical Services (34 of 180 victims).
06Six Month Trend Context
Listings rose for three consecutive months, from 716 in May to 1,063 in August. August's increase of 201 was the largest monthly rise in the six months shown.
07Security Findings
- Misconfiguration66.5%
MX and DNS misconfiguration that may enable spoofing or phishing
620 of 933 - Botnet Activity62.6%
At least one IP address involved in botnet, malware propagation or spam propagation
584 of 933 - Software Vulnerability59.4%
Out-of-date services/products with potentially highly exploitable vulnerabilities
554 of 933 - Critical Exposed Network Services51.9%
Open RDP or SMB ports publicly visible
484 of 933 - Fraudulent Domains44.6%
At least one possible phishing domain
416 of 933 - Stealer Logs40.1%
At least one record found in stealer logs
374 of 933 - Credential Stuffing35.3%
At least one credential leaked in the last 90 days
329 of 933
Misconfiguration (66.5%) and Botnet Activity (62.6%) were the most common findings among scanned victims, and Credential Stuffing the least common (35.3%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- At 1,063 listings, August was the busiest month of the reporting period, and the number of active named groups rose from 61 to 79.
- Orova (45) and Storm (40) were first observed in our dataset, and Clop rose from 1 to 45 listings.
- Italy tripled to 51 victims and ranked third among countries.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.