01Threat Actor Distribution
- Qilin fell from 108 to 82 listings, while The Gentlemen rose from 76 to 121 and took the lead.
- Deadlock was first observed in our dataset with 74 listings and ranked third.
- Lockbit 5.0 rose from 26 to 49 listings, while DragonForce fell from 54 to 28.
02Geographic Distribution
- The US share fell from 44.0% to 34.4% as US victims declined from 315 to 268.
- Germany ranked second with 45 victims, and India rose from 6 to 25.
- Most of Deadlock's listings were outside the United States: it accounted for 10 of Spain's 18 victims and 8 of Italy's 26.
03Industry Distribution
- Manufacturing rose from 152 to 186 victims; The Gentlemen (31) and Deadlock (22) listed the most.
- Qilin listed more Professional, Scientific, and Technical Services victims (21) than Manufacturing victims (14).
- Public Administration rose from 18 to 31 victims and Real Estate Rental and Leasing from 15 to 26.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (39 of 268 victims).
- The Gentlemen listed the most victims in Germany (10 of 45 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- The Gentlemen listed the most victims in Manufacturing (31 of 186 victims).
- Qilin listed the most victims in Professional, Scientific, and Technical Services (21 of 134 victims).
06Six Month Trend Context
After peaking at 862 in March, listings fell for two consecutive months before rising to 778 in June. Over the six months, totals stayed between 716 and 862.
07Security Findings
- Misconfiguration69.9%
MX and DNS misconfiguration that may enable spoofing or phishing
522 of 747 - Software Vulnerability56.9%
Out-of-date services/products with potentially highly exploitable vulnerabilities
425 of 747 - Critical Exposed Network Services51.3%
Open RDP or SMB ports publicly visible
383 of 747 - Fraudulent Domains46.6%
At least one possible phishing domain
348 of 747 - Stealer Logs44.8%
At least one record found in stealer logs
335 of 747 - Botnet Activity30.9%
At least one IP address involved in botnet, malware propagation or spam propagation
231 of 747 - Credential Stuffing20.9%
At least one credential leaked in the last 90 days
156 of 747
Misconfiguration (69.9%) and Software Vulnerability (56.9%) were the most common findings among scanned victims, and Credential Stuffing the least common (20.9%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- The Gentlemen became the most active group for the first time, with 121 listings against Qilin's 82.
- Deadlock was first observed in our dataset with 74 listings, 22 of them in Manufacturing.
- The US share of victims fell from 44.0% to 34.4%, while the number of represented countries rose from 76 to 89.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.