Full Report
Comparitech observed a significant decline in ransomware attacks in April, partly as a result of the RansomHub gang “going dark”
Analysis Summary
# Incident Report: Decline in Ransomware Attacks Correlated with RansomHub Outage
## Executive Summary
Ransomware attacks saw a notable decline in April 2025 compared to previous months, primarily attributed to the apparent infrastructure outage experienced by the RansomHub ransomware group starting March 31st. While RansomHub ceased logging new victims, rival group Qilin subsequently saw a sharp increase in activity, suggesting a potential migration of affiliates. The primary impact noted is a reduced overall threat landscape during the reporting period, though specific organizational impact from these general statistics is not detailed.
## Incident Details
- **Discovery Date:** May 5, 2025 (Date of analysis/report publication)
- **Incident Date:** April 2025 (Period of observed decline)
- **Affected Organization:** Not applicable (General industry trend report)
- **Sector:** Ransomware threat landscape analysis
- **Geography:** Global context of observed activity
## Timeline of Events
### Initial Access
- **Date/Time:** March 31, 2025 (Start of major change)
- **Vector:** Not specified for subsequent attacks, but RansomHub infrastructure outage initiated the primary event.
- **Details:** RansomHub group began experiencing a "significant outage" on March 31st, leading to them "going dark."
### Lateral Movement
- Lateral movement details are not specified as this report focuses on overall attack volume statistics rather than a single intrusion case study.
### Data Exfiltration/Impact
- The primary impact observed was a reduction in reported ransomware attacks logged by Comparitech: 479 in April, down from 530 (Jan), 973 (Feb), and 713 (Mar).
- Qilin activity saw an uptick from 45 attacks in March to 67 in April, supporting the theory of affiliate migration.
### Detection & Response
- **How it was discovered:** Analysis by Comparitech and Group-IB tracking ransomware victim sites and threat actor communications.
- **Response actions taken:** No specific organizational incident response actions are detailed in this macro-level report.
## Attack Methodology
Since this report is a summary of threat landscape statistics and not an analysis of a single breach, specific TTPs (Tactics, Techniques, and Procedures) for *all* attacks are generalized based on the actors mentioned:
- **Initial Access:** Not specified for the lower volume of attacks in April. RansomHub ceased listing new victims.
- **Persistence:** Unknown/Not specified.
- **Privilege Escalation:** Unknown/Not specified.
- **Defense Evasion:** Unknown/Not specified.
- **Credential Access:** Unknown/Not specified.
- **Discovery:** Unknown/Not specified.
- **Lateral Movement:** Unknown/Not specified.
- **Collection:** Unknown/Not specified.
- **Exfiltration:** Unknown/Not specified.
- **Impact:** Ransomware deployment (implied by the focus on ransomware volume).
## Impact Assessment
- **Financial:** Not calculated for this general trend report.
- **Data Breach:** Statistics on confirmed breaches are low (39 of 479 attacks were confirmed by the targeted entity). Specific data types are not detailed.
- **Operational:** Decreased pressure from high-volume ransomware activity during April (relative to Q1 2025).
- **Reputational:** No specific reputational damage noted for individual organizations in this summary.
## Indicators of Compromise
No specific IOCs (Indicators of Compromise) are provided, as the report focuses on threat group activity volume rather than specific malicious artifacts.
## Response Actions
* **Containment measures:** Not applicable at a macro level.
* **Eradication steps:** Not applicable at a macro level.
* **Recovery actions:** Not applicable at a macro level.
## Lessons Learned
- The operational stability of established ransomware-as-a-service (RaaS) infrastructure can significantly impact overall global ransomware volume.
- The ransomware ecosystem is highly fluid; affiliates rapidly migrate to active, functioning RaaS platforms (e.g., potential shift from RansomHub to Qilin).
## Recommendations
- Organizations should monitor the activity and shifts among major RaaS forums and infrastructure, as operator outages create movement opportunities for affiliates employing other groups.
- Maintain robust defense posture regardless of reported dips in attack volume, as threat actor groups are constantly evolving or re-emerging under new banners (e.g., the potential rise of Qilin affiliates).