Ransomware in 2025: Qilin Dominates as New Threats Emerge

The Evolving Ransomware Landscape: Fewer Attacks, But More Dangerous

April 2025 saw a surprising 29% drop in ransomware attacks compared to March, with 470 reported victims worldwide. But don’t let the numbers fool you cybercriminals aren’t slowing down. Instead, they’re getting smarter, more selective, and more aggressive in their tactics.

The manufacturing sector remains the top target, closely followed by information technology, while the U.S. continues to be the most attacked country. Behind these attacks, a few key players are reshaping the ransomware game some old, some new, and all more dangerous than ever.

Qilin Ransomware: The Unstoppable Leader

Leading the pack is Qilin, which saw a staggering 71.4% surge in activity last month, claiming 72 victims—far more than any other group. Their rapid rise suggests they’ve either improved their infrastructure or absorbed talent from disbanded gangs.

Other notable groups include:

• Play ransomware (75.9% increase in attacks)

• DragonForce (25% growth)

But while these established players dominate, new threats are emerging, proving that the ransomware ecosystem is far from stagnant.

New Players Enter the Game: Silent & Crypto24

Two newcomers made waves in April: Silent and Crypto24. Their sudden appearance coincides with the unexpected shutdown of RansomHub, hinting at a possible reshuffling of cybercriminal talent.

Silent Ransomware: Stealing Data, Not Just Encrypting It

Unlike traditional ransomware, Silent focuses on data theft rather than encryption. They infiltrate networks, steal sensitive corporate data, and threaten to sell it to competitors or leak it online—giving victims extra pressure to pay up.

With four confirmed victims already, Silent’s stealthy approach makes them harder to detect, posing a unique challenge for cybersecurity teams.

Crypto24: Aggressive & Fast-Moving

Meanwhile, Crypto24 has already claimed eight victims since its debut. Experts believe they may be absorbing former RansomHub affiliates, leveraging their experience to launch rapid, high-impact attacks.

Inside a Modern Ransomware Attack: How FOG Operates

To understand how sophisticated ransomware has become, let’s break down FOG’s multi-stage attack process:

1. Phishing Emails: Victims receive a malicious ZIP file (“Pay Adjustment.zip”) containing a disguised LNK file.

2. PowerShell Execution: Once opened, it runs a script (stage1.ps1) that downloads additional malware.

3. Privilege Escalation: Uses a hacked driver (iQVW64.sys) to gain admin rights.

4. Data Harvesting: Collects system details, geolocation, and more.

5. Virtual Machine Detection:  Checks if it’s running in a sandbox to evade analysis.

6. Encryption & Extortion: Files get the “.flocked” extension, and a ransom note drops with politically charged messaging.

What makes FOG unique? It forces victims to spread the malware further, adding a social engineering twist to traditional ransomware tactics.

How Businesses Can Stay Protected

With ransomware evolving rapidly, companies must upgrade their defenses. Here’s what experts recommend:

• Train employees to spot phishing attempts.

• Patch vulnerabilities especially in drivers and remote access tools.

• Back up critical data offline to prevent encryption attacks.

• Monitor network traffic for unusual activity.

• Implement zero-trust security to limit lateral movement.

The Future of Ransomware in 2025

While attack numbers dipped in April, the threat level hasn’t decreased. Ransomware gangs are more organized, more targeted, and more dangerous than ever.

Qilin’s dominance, combined with rising players like Silent and Crypto24, means businesses can’t afford to relax. Staying ahead requires constant vigilance, updated security measures, and rapid response plans