01Threat Actor Distribution
- Qilin accounted for 61 victims, representing 12.9% of total activity.
- INC Ransom followed with 56 disclosures.
- SafePay and Akira remained consistently active.
02Geographic Distribution
- United States of America represented 47.1% of all tracked victims.
- Others was among the next most impacted countries.
- Canada and United Kingdom of Great Britain also saw notable activity.
03Industry Distribution
- Manufacturing remained the most targeted sector.
- Professional, Scientific, and Technical Services followed as a heavily impacted sector.
- Others and Wholesale Trade continued to be operationally critical targets.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
Others
Beast
Lynx
Payouts King
DragonForce
Play
World Leaks
Akira
SafePay
INC Ransom
Qilin
USA
58
1
6
8
16
20
11
21
24
30
29
Canada
7
1
3
1
2
5
2
UK
7
1
2
3
4
1
2
Germany
3
2
3
4
1
2
3
1
Italy
4
2
2
1
3
1
1
4
Spain
5
1
1
1
1
3
France
4
1
1
1
1
3
Brazil
9
1
1
Turkey
6
1
2
Thailand
5
1
1
Australia
1
1
3
1
Japan
3
1
1
Sweden
1
2
1
1
Singapore
2
2
1
Belgium
1
1
1
2
Others
43
14
3
2
4
3
8
6
12
Grand Total
158
16
16
16
21
23
24
39
43
56
61
- Grand Total activity was heavily concentrated in Others.
- Some actors demonstrated narrow targeting patterns.
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
Others
Beast
Lynx
Payouts King
DragonForce
Play
World Leaks
Akira
SafePay
INC Ransom
Qilin
Professional, Scientific, and Technical Services
31
3
3
3
3
3
6
9
9
14
12
Manufacturing
26
5
6
5
5
9
12
7
3
16
Other Services (except Public Administration)
19
10
2
1
1
2
4
6
Wholesale Trade
11
1
3
2
2
8
3
Health Care and Social Assistance
9
1
2
1
4
7
3
1
Construction
5
3
3
2
3
4
5
Retail Trade
5
1
1
2
1
3
1
4
5
Information
9
1
2
2
1
1
3
Public Administration
7
1
1
1
1
5
3
Finance and Insurance
10
1
1
1
1
3
Educational Services
8
1
1
3
2
1
Real Estate Rental and Leasing
1
1
1
3
2
1
2
Administrative and Support and Waste Management and Remediation Services
5
1
1
1
2
1
1
Management of Companies and Enterprises
6
1
1
1
Transportation and Warehousing
1
1
1
1
1
2
1
Accommodation and Food Services
1
2
1
1
1
2
Agriculture, Forestry, Fishing and Hunting
1
2
1
1
Utilities
3
1
Arts, Entertainment, and Recreation
1
2
Mining
1
- Professional, Scientific, and Technical Services activity was heavily concentrated in Others.
- Some actors demonstrated narrow targeting patterns.
06Six Month Trend Context
07Key Takeaways
- 473 ransomware disclosures were observed in July 2025.
- Qilin led activity with 61 victims.
- United States of America accounted for 47.1% of disclosures.
- Manufacturing remained the most targeted industry.
08Data Methodology and Sources
- Victim counts are based on publicly disclosed ransomware leak site postings tracked during the reporting period.
- Each victim is attributed to a single threat actor based on disclosure source.
- Industry classification is assigned using standardized sector mapping.
- Country attribution is based on headquarters location where identifiable.