01Threat Actor Distribution
- Akira rose from 48 to 83 listings and moved into second place.
- DragonForce (36 to 57) and Lockbit 5.0 (34 to 53) also increased, while Clop fell to 2 listings.
- AiLock (24) and ALP-001 (12) were first observed in our dataset.
02Geographic Distribution
- France doubled from 22 to 44 victims and became the second most represented country; Qilin (10) and The Gentlemen (9) listed the most.
- US victims rose from 370 to 416, with Qilin (76) and Akira (55) the largest contributors.
- Germany (20 to 32), the United Kingdom (18 to 29) and Spain (10 to 20) also increased.
03Industry Distribution
- Manufacturing rose from 164 to 195 victims; 25 of The Gentlemen's 74 listings were in Manufacturing.
- Each of the five leading industries recorded more victims than in February, led in absolute terms by Manufacturing (+31) and Professional, Scientific, and Technical Services (+19).
- DragonForce's largest sector was Construction (11), whereas Qilin, Akira and The Gentlemen each listed Manufacturing most often.
04Threat Actor × Country Matrix
The matrix below shows how leading ransomware groups distributed their activity geographically.
- Qilin listed the most victims in the United States (76 of 416 victims).
- Qilin listed the most victims in France (10 of 44 victims).
05Threat Actor × Industry Matrix
This view highlights sector specialization across leading ransomware groups.
- Qilin listed the most victims in Manufacturing (31 of 195 victims).
- Qilin listed the most victims in Professional, Scientific, and Technical Services (25 of 168 victims).
06Six Month Trend Context
March's 862 listings were the highest of the six months, ending a period in which monthly totals had moved between 717 and 813 since October.
07Security Findings
- Misconfiguration69.8%
MX and DNS misconfiguration that may enable spoofing or phishing
582 of 834 - Critical Exposed Network Services52.6%
Open RDP or SMB ports publicly visible
439 of 834 - Fraudulent Domains52.3%
At least one possible phishing domain
436 of 834 - Software Vulnerability47.5%
Out-of-date services/products with potentially highly exploitable vulnerabilities
396 of 834 - Stealer Logs39.9%
At least one record found in stealer logs
333 of 834 - Credential Stuffing16.3%
At least one credential leaked in the last 90 days
136 of 834 - Botnet Activity2.3%
At least one IP address involved in botnet, malware propagation or spam propagation
19 of 834
Misconfiguration (69.8%) and Critical Exposed Network Services (52.6%) were the most common findings among scanned victims, and Botnet Activity the least common (2.3%). Scans can take place after the disclosure date, so these figures describe exposure at the time of the scan.
08Key Takeaways
- Listings rose 14.9% to 862, and 58 named groups were active, up from 53.
- France doubled to 44 victims and ranked second among countries.
- Akira rose from 48 to 83 listings and moved into second place.
09Data Methodology and Sources
- The Black Kite Research Group monitors ransomware leak sites and supporting threat intelligence sources to track publicly disclosed victims.
- Victims are categorized by headquarters country and industry using NAICS classifications.
- Repeated listings of the same victim by the same threat actor are counted once, while disclosures by different actors are recorded separately.
- Since not all ransomware incidents become public, the figures reflect observed disclosures rather than the full extent of ransomware activity.