Ransomware Threats. 2025 Report.
The ransomware landscape has shifted. Attackers now treat backup infrastructure as a primary target. This report covers the threats, trends, and techniques defining 2025.
- $57B
- Projected damages by end of 2025
- 65%
- of financial orgs hit in 2024
- 84%
- of boards discuss ransomware quarterly
Get the full report
The numbers behind 2025’s threat landscape.
Elastio threat research telemetry and industry data, covering backup-targeting ransomware trends.
- 143%
- YoY increase in ransomware targeting backup infrastructure
- 17 days
- Average dwell time before ransomware detonation in backups
- 68%
- Of organizations hit by ransomware had compromised backup copies
- $4.7M
- Average recovery cost when backups are compromised
Most active groups in 2025.
Ransomware groups actively targeting backup infrastructure this year.
| Group | Variant | Sectors | First Seen | Severity |
|---|---|---|---|---|
| LockBit 4.0 | LockBit Black, LockBit Green | Healthcare, Financial Services, Manufacturing | Q1 2025 | Critical |
| BlackSuit | Royal rebrand | Critical Infrastructure, Government, Education | Q4 2024 | Critical |
| Akira | Akira_v2 | Small & Mid-size Enterprises, Professional Services | Major 2025 variant | High |
| Medusa | MedusaLocker 2025 | Healthcare, Legal, Financial Services | Q2 2025 | Critical |
| RansomHub | RaaS Collective | Cross-sector, Managed Service Providers | Q1 2025 | High |
Defining shifts this year.
The techniques and patterns that security teams need to address now.
- Critical
AI-Accelerated Ransomware Development
Threat actors are using large language models to rapidly generate polymorphic ransomware variants, reducing the development cycle from months to days and evading signature-based detection.
- Critical
Backup Infrastructure as Primary Target
Over 70% of ransomware attacks in 2025 explicitly target backup systems before encrypting production data, making backup integrity validation an essential security control.
- Critical
Supply Chain Backup Compromise
Attackers are compromising backup software vendors and MSP management platforms to gain access to thousands of downstream backup environments simultaneously.
- High
Time-Delayed Payload Injection
Ransomware increasingly uses dormancy periods of 14 to 45 days, silently corrupting backup snapshots across retention windows before triggering visible encryption.
- High
Cloud-Native Snapshot Manipulation
New attack techniques exploit cloud IAM misconfigurations to modify or delete EBS snapshots, S3 Object Lock policies, and cross-region replication targets.
- Medium
Regulatory Pressure on Recovery Proof
DORA, SEC disclosure rules, and NYDFS 500 amendments now require organizations to demonstrate provable recovery capability, not just backup existence.
Major incidents and milestones across 2025.
Key events shaping the ransomware threat landscape, quarter by quarter.
Q1 2025
- Threat
LockBit 4.0 variant emerges with enhanced backup-targeting capabilities
- Breach
Major healthcare breach via compromised Veeam backup admin credentials
- Advisory
CISA issues advisory on ransomware targeting immutable storage platforms
- Threat
Q2 2025
- Breach
Medusa triple-extortion campaign hits 200+ organizations globally
- Threat
First documented attack using AI-generated polymorphic ransomware payload
- Regulatory
SEC fines three public companies for inadequate recovery capability disclosure
- Breach
Q3 2025
- Threat
RansomHub RaaS platform surpasses 1,000 affiliates
- Breach
Supply chain attack compromises popular MSP backup management tool
- Advisory
NIST releases updated Ransomware Risk Management framework (SP 1800-26 Rev.2)
- Threat
Q4 2025
- Breach
BlackSuit targets critical infrastructure across 12 countries simultaneously
- Threat
Cloud-native snapshot manipulation attacks increase 280% QoQ
- Regulatory
DORA enforcement begins with first compliance penalties in EU financial sector
- Breach
Are your backups prepared for 2025’s threats?
The Hunt Engine detects ransomware inside your data before you need to recover.