01Threat Actor Distribution
- Qilin rose from 82 to 135 listings after its June low, while The Gentlemen added 17.
- Deadlock fell from 74 listings to 21 in its second month in our dataset.
- CRPx0 (34) and Global Secret Group (31) were first observed in our dataset; 32 of CRPx0's listings were US victims.
02Geographic Distribution
- US victims rose from 268 to 361; Qilin's US listings rose from 39 to 67.
- Qilin (67), The Gentlemen (41) and CRPx0 (32) were the largest contributors to US listings.
- India ranked fourth with 30 victims, up from 25, and the United Kingdom rose from 15 to 28.
03Industry Distribution
- Health Care and Social Assistance rose from 44 to 68 victims, tying with Wholesale Trade for third place.
- Qilin was the leading group in Health Care and Social Assistance (11), followed by CRPx0 and INC Ransom (8 each).
- Manufacturing remained the most affected industry with 199 victims; The Gentlemen (33) and Qilin (32) together accounted for 65 of them.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (67 of 361 victims).
- SafePay listed the most victims in Germany (23 of 42 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- The Gentlemen listed the most victims in Manufacturing (33 of 199 victims).
- The Gentlemen listed the most victims in Professional, Scientific, and Technical Services (18 of 148 victims).
06Six Month Trend Context
Listings rose for a second consecutive month to 862, matching March's total of 862; these two months share the highest total in the six months shown.
07Security Findings
- Misconfiguration69.6%
MX and DNS misconfiguration that may enable spoofing or phishing
539 of 774 - Botnet Activity55.7%
At least one IP address involved in botnet, malware propagation or spam propagation
431 of 774 - Software Vulnerability55.3%
Out-of-date services/products with potentially highly exploitable vulnerabilities
428 of 774 - Critical Exposed Network Services51.0%
Open RDP or SMB ports publicly visible
395 of 774 - Fraudulent Domains44.7%
At least one possible phishing domain
346 of 774 - Stealer Logs39.8%
At least one record found in stealer logs
308 of 774 - Credential Stuffing20.0%
At least one credential leaked in the last 90 days
155 of 774
Misconfiguration (69.6%) and Botnet Activity (55.7%) were the most common findings among scanned victims, and Credential Stuffing the least common (20.0%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- The Gentlemen (138) and Qilin (135) were separated by only 3 listings.
- Deadlock fell from 74 to 21 listings, one month after it was first observed in our dataset.
- Health Care and Social Assistance rose from 44 to 68 victims, with Qilin, CRPx0 and INC Ransom listing the most.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.