01Threat Actor Distribution
- The Gentlemen doubled from 45 to 90 listings and ranked second behind Qilin (129).
- Clop fell from 90 to 35 listings and Sinobi from 57 to 17.
- Insomnia was first observed in our dataset with 27 listings, and DragonForce rose from 9 to 36.
02Geographic Distribution
- US victims rose from 325 to 370; Qilin accounted for 72 of them, more than twice any other group.
- Most of The Gentlemen's listings were outside the United States; Thailand was its largest country with 11 of Thailand's 17 victims.
- Victims were recorded in 71 countries, up from 60, while the United Kingdom fell back from 45 to 18.
03Industry Distribution
- Health Care and Social Assistance rose from 34 to 50 victims; Qilin (10) and Insomnia (8) listed the most.
- Administrative and Support and Waste Management and Remediation Services nearly doubled from 16 to 31 victims.
- Qilin listed more victims in Professional, Scientific, and Technical Services (25) than in Manufacturing (23).
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (72 of 370 victims).
- Akira listed the most victims in Canada (4 of 33 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- Qilin listed the most victims in Manufacturing (23 of 164 victims).
- Qilin listed the most victims in Professional, Scientific, and Technical Services (25 of 149 victims).
06Six Month Trend Context
Since October's jump, monthly listings have stayed between 717 and 813 without a sustained direction; February's 750 sits in the lower half of that range.
07Security Findings
- Misconfiguration69.0%
MX and DNS misconfiguration that may enable spoofing or phishing
493 of 715 - Fraudulent Domains55.7%
At least one possible phishing domain
398 of 715 - Critical Exposed Network Services52.4%
Open RDP or SMB ports publicly visible
375 of 715 - Software Vulnerability46.0%
Out-of-date services/products with potentially highly exploitable vulnerabilities
329 of 715 - Stealer Logs41.0%
At least one record found in stealer logs
293 of 715 - Credential Stuffing14.8%
At least one credential leaked in the last 90 days
106 of 715 - Botnet Activity4.5%
At least one IP address involved in botnet, malware propagation or spam propagation
32 of 715
Misconfiguration (69.0%) and Fraudulent Domains (55.7%) were the most common findings among scanned victims, and Botnet Activity the least common (4.5%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- The Gentlemen doubled its listings to 90 and ranked second for the first time.
- Clop's listings fell from 90 to 35, one month after its January increase.
- Health Care and Social Assistance rose from 34 to 50 victims, with Qilin and Insomnia listing the most.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.