01Threat Actor Distribution
- Clop rose from 1 listing in December to 90, the largest increase of any group.
- Lockbit 5.0 fell from 91 to 8 listings and SafePay from 67 to 11.
- Qilin remained first with 117 listings, down from 195; its share of the total fell from 24.0% to 16.3%.
02Geographic Distribution
- The United Kingdom rose from 26 to 45 victims, moving from fourth to second place.
- Clop's listings were spread across several countries: 40 in the United States, 18 in Canada, 11 in Australia and 9 in the United Kingdom.
- Victims were recorded in 60 countries, down from 68 in December.
03Industry Distribution
- Manufacturing (167) and Professional, Scientific, and Technical Services (148) together accounted for 43.9% of listings, up from 39.5% in December.
- With 36 listings, Clop was the leading group in Professional, Scientific, and Technical Services, ahead of Qilin (15).
- Health Care and Social Assistance (49 to 34), Wholesale Trade (47 to 34) and Retail Trade (47 to 35) all declined.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (48 of 325 victims).
- Clop listed the most victims in UK (9 of 45 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- Qilin listed the most victims in Manufacturing (38 of 167 victims).
- Clop listed the most victims in Professional, Scientific, and Technical Services (36 of 148 victims).
06Six Month Trend Context
After rising from 509 in August to 771 in October, monthly listings alternated between declines and increases. January's 717 was the lowest total since September.
07Security Findings
- Misconfiguration69.8%
MX and DNS misconfiguration that may enable spoofing or phishing
467 of 669 - Fraudulent Domains51.1%
At least one possible phishing domain
342 of 669 - Critical Exposed Network Services46.0%
Open RDP or SMB ports publicly visible
308 of 669 - Software Vulnerability42.6%
Out-of-date services/products with potentially highly exploitable vulnerabilities
285 of 669 - Stealer Logs33.3%
At least one record found in stealer logs
223 of 669 - Credential Stuffing14.5%
At least one credential leaked in the last 90 days
97 of 669 - Botnet Activity10.3%
At least one IP address involved in botnet, malware propagation or spam propagation
69 of 669
Misconfiguration (69.8%) and Fraudulent Domains (51.1%) were the most common findings among scanned victims, and Botnet Activity the least common (10.3%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- Listings fell 11.8% to 717, but Clop rose from 1 listing to 90, ranking second.
- Lockbit 5.0 dropped from 91 to 8 listings, one month after it was first observed in our dataset.
- The United Kingdom rose from 26 to 45 victims and moved from fourth to second place among countries.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.