Full Report
Ransomware payments stagnated despite record attacks claimed. Total on-chain ransomware payments fell by approximately 8% to $820 million in 2025, even as claimed attacks rose 50%. Median ransom payment size increased significantly. While aggregate revenue stagnated, the median ransom payment grew 368% year-over-year to nearly $60,000. Initial Access Broker (IAB) activity can serve as a leading indicator; on-chain analysis indicates that spikes in IAB inflows typically precede increases in ransomware payments and victim leaks by roughly 30 days.
Analysis Summary
# Incident Report: 2025 Ransomware Economy Analysis
## Executive Summary
The ransomware landscape in 2025 saw a significant increase in the volume of claimed attacks (up 50%), yet the total on-chain ransomware payments stagnated, declining by 8% to approximately $820 million. This divergence suggests improved defense, regulatory pressure, or infrastructure disruption efforts are reducing payout frequency, despite attackers working harder (smaller victims targeted). A key indicator observed is that spikes in Initial Access Broker (IAB) activity predict subsequent ransomware payment/victim leak events by roughly 30 days.
## Incident Details
- **Discovery Date:** Analysis conducted throughout 2025, informed by data finalized in February 2026.
- **Incident Date:** Throughout the calendar year 2025.
- **Affected Organization:** Not applicable (Summary of industry trends).
- **Sector:** Cross-sectoral, with a visible trend shift toward Small and Medium Enterprises (SMEs).
- **Geography:** Global/Worldwide trends analyzed.
## Timeline of Events
*Note: The timeline reflects observational patterns leading to the 2025 financial outcomes, not specific organizational breaches.*
### Initial Access
- **Date/Time:** Approximately 30 days prior to observed ransomware payments/leaks.
- **Vector:** General attacks surged across multiple vectors, often targeting SMEs. The report highlights the general convergence of infrastructure used by both cybercriminals and state-linked actors.
- **Details:** Spikes in Initial Access Broker (IAB) inflows serve as a leading indicator for subsequent activity.
### Lateral Movement
- **Details:** The infrastructure layer showed convergence, with actors utilizing the same bulletproof hosting and residential proxy networks, indicating shared resources across financially motivated and state-aligned groups.
### Data Exfiltration/Impact
- **Details:** Attackers are making more public claims of victims (50% rise), but the lower aggregate payment total ($820M) suggests a lower proportion of successful high-value extortions compared to previous years, possibly due to improved resilience leading to fewer payouts.
### Detection & Response
- **Detection:** Analysis relies on on-chain tracking of ransomware wallets and external victim reporting (e.g., eCrime.ch data).
- **Response Actions:** Law enforcement and private sector actions increasingly targeted the enablement layer, including sanctions and disruption efforts aimed at bulletproof hosting and malware loading tools.
## Attack Methodology
Due to the nature of the summary, specific technical deployment is generalized based on known ransomware trends:
- **Initial Access:** Utilized various vectors, often focused on SMEs. The use of IAB-acquired access was a predictable precursor.
- **Persistence:** Not explicitly detailed, but implied through the continued use of sophisticated underlying infrastructure (bulletproof hosting).
- **Privilege Escalation:** Not detailed.
- **Defense Evasion:** Actors leveraged converged infrastructure, including shared residential proxy networks, to evade detection across financially motivated and state-linked campaigns.
- **Credential Access:** Not detailed.
- **Discovery:** Not detailed.
- **Lateral Movement:** Unspecified, but facilitated by shared infrastructure.
- **Collection:** Not detailed.
- **Exfiltration:** Publication of claims suggests exfiltration occurred, driving the 50% rise in claimed victims.
- **Impact:** Reduced aggregate revenue, despite increased claims, suggesting defenses were partially effective in limiting financial impact, even if breaches occurred. Some strains (e.g., VolkLocker) were rendered obsolete by technical vetting.
## Impact Assessment
- **Financial:** Total on-chain payments fell 8% ($892M in 2024 estimate to $820M in 2025). However, the **median ransom payment increased dramatically by 368% to nearly $60,000**, indicating that when victims *did* pay, the stakes were much higher for those specific incidents.
- **Data Breach:** A 50% year-over-year increase in *claimed* victims suggests a much broader scope of compromise activity.
- **Operational:** Reduced overall payout frequency suggests improved organizational resilience against paying the ransom.
- **Reputational:** Not detailed, but increased decentralization suggests more groups attempting to cause localized reputational harm.
## Indicators of Compromise
*Note: This report analyzes financial and activity indicators, not specific TTPs for a single incident.*
- **Network Indicators:** Spikes in cryptocurrency inflows to known Initial Access Broker (IAB) wallets. (Specific wallet addresses not provided).
- **File Indicators:** Mentions of specific ransomware strains like VolkLocker, which contained a cryptographic weakness allowing free decryption in some cases.
- **Behavioral Indicators:** A 30-day lag between IAB inflows and subsequent victim leaks/ransom demands. A high volume of claimed attacks paired with stagnating total revenue.
## Response Actions
- **Containment measures:** Not detailed for specific incidents, but organizational improvements led to a lower payout frequency.
- **Eradication steps:** Not detailed, but noted that successful international sanctions and law enforcement actions targeted the ecosystem's underlying infrastructure components (hosting, malware loading tools).
- **Recovery actions:** Not detailed.
## Lessons Learned
- **IAB activity is a critical forecasting tool:** Spikes in IAB inflows reliably precede major crime events by about 30 days, offering a preparatory window.
- **Defense is shifting incentives:** Improved incident response and regulatory scrutiny are successfully forcing attackers to work harder for diminishing aggregate returns.
- **Decentralization and Targeting Shift:** The move away from large RaaS operations to smaller, fragmented groups favors targeting SMEs, which attackers believe will pay faster.
## Recommendations
- Organizations should monitor IAB activity indicators (if available) as a proactive warning signal for potential imminent attacks.
- Focus disruption efforts on the enablement layer (infrastructure, hosting services) to increase operational costs for threat actors across the board.
- Given the high median ransom ($60k), organizations must increase resilience and prepare for potentially high-cost incidents, even if the frequency of paying decreases.