Full Report
The worldwide ransomware landscape saw a dramatic shift in attacks in October 2025, jumping 41% month over month, with the most prolific attacker, Qlin, more than doubling the number of attacks it launched, according to Trustwave, A LevelBlue Company, research. The US remained the primary recipient of ransomware attacks, but October saw manufacturing overtake technology as the most targeted vertical sector. The ransomware information was derived from a new SpiderLabs ransomware-tracking tool that gathers information from a variety of open intelligence sources and our own proprietary research. This unique combination of open-source and in-house research provides new insights into ransomware attack trends, the threat groups involved, and their primary targets. The data is not all-inclusive but contains enough information to draw basic conclusions on the direction attacks are taking. October Attack Figures In October 2025, SpiderLabs recorded 722 ransomware attacks worldwide, up from 492 in September 2025 and 635 in October 2024. As noted, the US was the nation most under attack with 298 incidents noted, followed by Canada and France with 45 and 25 attacks, respectively. Top 5 Threat Groups Qlin again dominated the stage, but there were some changes in the top five list. Sinobi appeared in third place, pushing Incransom down to fourth and Play to fifth. A quick breakdown of the new threat actor on the list: According to Ransomware.live, Sinobi became active in July 2025 and has so far specialized in attacking healthcare, manufacturing, and construction firms. Top Threat Groups for October 2025 Threat Groups Oct. 2025 Number of Attacks Threat Groups Sept. 2025 Number of Attacks Qilin 191 or 26.5% Qlin 61 or 15.2% Akira 71 or 9.8% Akira 42 or 10.4% Sinobi 62 or 8.6% Sinobi 36 or 8.9% Incransom 30 or 4.3% Incransom 31 or 7.7% Play 22 or 3.1% Play 29 or 7.2% Top Vertical Sectors Targeted for October 2025 Sector Oct. 2025 Number of Attacks as a % Sector Sept. 2025 Number of Attacks as a % Manufacturing 101 or 14% Business Services 150 or 23.6% Technology 76 or 10.5% Manufacturing 84 or 13.2% Healthcare 59 or 8.2% Technology 79 or 12.4% Business Services 33 or 4.6% Healthcare 63 or 10% Construction 29 or 4% Government 38 or 6% SpiderLabs’ research noted a major shift in targeting when data is examined year over year. In October of 2024, business services were the most often targeted vertical sector, followed by manufacturing and technology. 2025 Ransomware Attacks to Date Threat Group Number of Attacks Target Sector Number of Attacks Qilin 724 or 11.6% Manufacturing 726 or 11.7% Akira 577 or 9.2% Technology 735 or 11.7% Sinobi 419 or 6.7% Healthcare 420 or 6.8% Incransom 332 or 5.3% Business Services 334 or 5.3% Play 283 or 4.5% Financial Services 311 or 5% Total attacks tracked to date for 2025 are 6,251, up dramatically from the 4,660 SpiderLabs saw in 2024. One data point from the target sector list to call out for October is manufacturing supplanted technology as the threat actor’s favorite victim sector. Defending Against Ransomware Trustwave, A LevelBlue Company, offers a number of services and solutions to help organizations defend themselves against ransomware and recover if successfully attacked. Trustwave’s Ransomware Preparedness service, unlike many offerings in the market today, doesn’t focus on singular aspects of a client’s security defense but looks at all critical lines of defense, using detailed insights and aggregated information to provide client security and business leaders. The service provides detailed assessments of the organization’s overall preparedness, an understanding of its existing capabilities to identify, respond to, and recover from a ransomware incident, and identification of the gaps, opportunities, and inherent risks it faces. In addition, Trustwave can help with the basic mitigations all organizations should implement including: Enhance cybersecurity hygiene and patch management Implement robust backup and recovery plans Employee training and awareness Multi-Factor Authentication (MFA) and strong credential management Incident response planning
Analysis Summary