Current Malware Trends: What Security Teams Need to Know
What Are the Biggest Malware Trends Right Now? The malware landscape has fundamentally shifted. Traditional malware that …
Learn why stolen credentials are the first step in most ransomware attacks.
• A gap exists between credential theft and ransomware deployment, giving you time to act.
• Endpoint detection triggers after attackers have been inside for days or weeks.
• Infostealers capture credentials that get sold to ransomware operators through dark web markets.
• Credential monitoring catches leaked passwords before they get exploited.
Ransomware is present in 44% of all breaches according to the 2025 Verizon DBIR. That’s not a typo. Nearly half of every breach now involves ransomware in some form.
Here’s what makes this worse: reported ransomware incidents are actually declining. But dark web ransomware activity increased 25% year-over-year according to IBM X-Force. The attacks aren’t slowing down. They’re just going undetected longer.
Most security teams focus on endpoint detection and backup strategies. That’s important, but it’s reactive. By the time ransomware encrypts your files, the attackers have already been inside for days or weeks.
The real opportunity is detecting ransomware activity before it hits your network. That means watching the dark web where stolen credentials and network access get sold before attackers use them.
Contents
What Are the Current Ransomware Trends?
The ransomware landscape looks different than most headlines suggest. Reported incidents are declining for the third consecutive year according to IBM X-Force. Yet ransomware remains present in 44% of all breaches.
Ransomware trends describe how ransomware tactics evolve. Key shifts include double extortion (encrypting data AND threatening to leak it) and data-theft-only extortion (stealing without encryption). Ransomware-as-a-Service lets affiliates launch attacks without technical expertise. They buy network access using credentials stolen by infostealer malware.
What’s actually happening? The attackers are getting smarter about avoiding detection. Dark web ransomware activity increased 25% year-over-year (IBM X-Force 2025), suggesting attacks continue but victims either pay quietly or never discover they were hit.
The biggest shift is the move toward data theft extortion. Mandiant’s M-Trends 2025 report shows that 11% of cases now involve data theft without any encryption at all. Another 6% combine both encryption and data theft. Ransomware groups figured out that stealing data creates leverage even when victims have good backups.
Cross-platform capability is now standard. Every major ransomware family supports Windows and Linux. Most also target ESXi hypervisors. When attackers gain access, they can encrypt everything regardless of operating system.
The RaaS (Ransomware-as-a-Service) model continues evolving, but law enforcement pressure has destabilized major players. This creates chaos as affiliates migrate between platforms, but it also creates opportunity. Groups in transition make mistakes and leave traces that security teams can detect.
Understanding which groups are active matters for threat intelligence. But knowing how they operate matters more for prevention.
Which Ransomware Groups Are Most Active?
The ransomware hierarchy shifted dramatically in 2025. Qilin now leads after RansomHub’s unexpected collapse in April 2025. According to Rapid7’s Q2 2025 analysis, 65 active ransomware groups operated during that quarter, though 17 groups became inactive between Q1 and Q2.
Here’s what the current landscape looks like:
Qilin emerged as the top group by exploiting affiliate economics. They offer 80-85% commission on ransom payments, attracting experienced operators from collapsed groups. They target Windows, Linux, and ESXi, letting them encrypt entire virtualized environments.
Akira (tracked by Mandiant as REDBIKE) remains highly active with code connections to the defunct Conti ransomware. They target primarily mid-market organizations.
Play focuses on North American targets and maintains a lower profile than groups seeking media attention.
DragonForce allegedly absorbed RansomHub’s infrastructure through what analysts describe as a hostile takeover. They gained experienced affiliates, making them a growing threat.
The services sector accounts for 44.4% of ransomware victims (Rapid7 Q2 2025), followed by healthcare at 10.6% and technology at 10%. Geographic targeting remains concentrated with 66% of victims in the United States.
For security teams, this volatility creates both risk and opportunity. Group collapses mean stolen credentials and network access change hands. Monitoring for your organization’s credentials during these periods catches exposure before new operators exploit it.
How Does the Infostealer-to-Ransomware Pipeline Work?
This is the trend that matters most for prevention. Phishing campaigns now deliver infostealer malware 84% more often than last year according to IBM X-Force 2025. That’s not a random statistic. It’s the feeding mechanism for ransomware operations.
Infostealer malware captures credentials and session tokens from infected devices. Unlike ransomware that announces itself immediately, infostealers operate silently, exfiltrating data to command servers. This stolen data then appears on dark web marketplaces where initial access brokers purchase credentials to sell network access to ransomware operators.
Here’s how the pipeline works:
Step 1: Initial Infection. An employee clicks a phishing link or downloads malicious software. Infostealers like RedLine and Vidar install silently and begin harvesting credentials from browsers. They also grab session tokens from active sessions.
Step 2: Data Exfiltration. The malware sends harvested credentials to attacker infrastructure. This includes VPN credentials and RDP logins. Session cookies that bypass MFA are especially valuable.
Step 3: Marketplace Sale. Stolen credentials appear on dark web marketplaces within days. Initial access brokers purchase credentials that provide corporate network access. A single infected employee device can expose dozens of corporate services.
Step 4: Network Access Sale. Initial access brokers verify which credentials still work, then sell network access to ransomware affiliates. The price depends on the target’s revenue and the level of access being sold.
Step 5: Ransomware Deployment. Ransomware operators use purchased access to enter networks and perform reconnaissance. They move laterally before deploying ransomware or exfiltrating data for extortion.
The critical insight: stolen credentials appear on dark web marketplaces before ransomware attacks begin. This creates a detection window. If you monitor for your organization’s credentials in infostealer logs and initial access broker listings, you can reset them before attackers use them.
The 12% increase in infostealer credentials for sale on the dark web (IBM X-Force 2025) means more organizations are exposed but haven’t been attacked yet. That exposure is detectable.
Which Industries Are Most Targeted by Ransomware?
Targeting patterns reveal which industries face the highest risk and why attackers prioritize certain sectors.
The services sector leads at 44.4% of ransomware victims according to Rapid7’s Q2 2025 analysis. This category includes professional services and consulting firms. Attackers target services companies because they often have access to client data and less mature security programs than enterprises.
Healthcare accounts for 10.6% of attacks. Medical organizations face unique pressure because ransomware can directly impact patient care. Attackers know healthcare providers may pay quickly to restore critical systems.
Technology companies account for 10% of victims. These targets offer potential supply chain access and valuable intellectual property.
But the most striking statistic comes from the 2025 Verizon DBIR: ransomware affects 88% of SMB breaches. Small and medium businesses experience ransomware at dramatically higher rates than large enterprises.
Why the SMB disparity? Smaller organizations often lack dedicated security teams and run outdated systems. They have limited visibility into dark web threats targeting them. They’re also less likely to make headlines when attacked, making them attractive targets for groups seeking quiet payouts.
For security teams, industry targeting matters for threat intelligence prioritization. If you’re in the services sector, ransomware groups are statistically more likely to target your organization. That doesn’t mean other industries are safe, but it should influence how you allocate monitoring resources.
What Does Ransomware Cost Organizations?
The financial impact extends far beyond ransom payments. IBM’s 2025 Cost of a Data Breach Report puts the average ransomware breach cost at $5.08 million when attackers disclose the breach. That’s among the most expensive breach categories.
Recovery costs average $1.5 million according to Sophos’ 2025 State of Ransomware report. This includes incident response and system restoration. Business disruption and remediation efforts continue for months after the attack.
Median ransom payments sit around $150,000 (2025 Verizon DBIR), though this figure varies enormously based on target size and attacker sophistication.
Here’s the significant shift: 63% of ransomware victims now refuse to pay according to IBM’s 2025 report, up from 59% in 2024. Organizations are getting better at recovery without payment, and the stigma of paying ransoms has increased.
However, refusing to pay doesn’t eliminate costs. Victims still face business disruption and forensic investigation expenses. Legal fees add up. Reputational damage compounds when stolen data appears on ransomware leak sites.
Law enforcement involvement is declining too. Only 40% of organizations contacted law enforcement in 2025, down from 52% in 2024. This trend reduces the intelligence available to help other potential victims.
The economics favor prevention. Detecting threats before attacks is dramatically cheaper than responding to successful ransomware deployments. That’s where dark web monitoring provides the most value.
How Can Security Teams Detect Ransomware Early?
Most ransomware detection focuses on endpoint behavior after attackers are already inside. Early detection means watching for precursors before the attack begins.
Monitor for Leaked Credentials
Your employees’ credentials may already be circulating on dark web marketplaces from infostealer infections or third-party breaches. Compromised credential monitoring catches these exposures before attackers exploit them.
Credentials from infostealer logs are especially dangerous because they often include session tokens that bypass MFA. When you detect exposed credentials, reset them immediately rather than waiting for suspicious login attempts.
Track Ransomware Leak Sites
Ransomware groups announce victims on dedicated leak sites before publishing stolen data. Monitoring these sites provides early warning when your organization or your vendors appear. This gives you time to assess exposure and begin incident response before data spreads.
Watch Initial Access Broker Activity
Initial access brokers advertise network access for sale on criminal forums. These listings often appear days or weeks before ransomware deployment. If you detect your organization’s network access being sold, you know an attack is coming.
Monitor Threat Actor Channels
Threat actors use Telegram and forum channels to sell network access and share stolen data. Monitoring these channels catches mentions of your organization or your data being sold. This provides early warning that your network may already be compromised.
Detect Third-Party Exposures
Your vendors may be compromised before you know about it. Monitoring for third-party breaches that could expose your data provides advance warning of supply chain attacks.
The common thread is shifting from reactive endpoint detection to proactive external threat intelligence. Stolen credentials and network access appear on the dark web before ransomware operators use them.
What Ransomware Prevention Measures Actually Work?
Generic advice like “implement MFA and maintain backups” isn’t wrong, but it’s incomplete. Here’s what actually prevents ransomware attacks.
Patch Exploited Vulnerabilities Fast
Exploited vulnerabilities remain the number one root cause of ransomware intrusions according to Sophos’s 2025 State of Ransomware. Not all vulnerabilities matter equally. Prioritize the ones actively exploited by ransomware groups, tracked through CISA’s Known Exploited Vulnerabilities catalog.
Monitor and Rotate Credentials Proactively
Don’t wait for alerts about suspicious logins. Actively search for your organization’s credentials on dark web marketplaces and infostealer logs. When you find exposed credentials, reset them immediately. This breaks the infostealer-to-ransomware pipeline.
Segment Networks to Limit Lateral Movement
When attackers gain initial access, network segmentation determines how far they can spread. Ransomware operators need time to move laterally and identify valuable targets. Proper segmentation buys you detection time and limits blast radius.
Assume MFA Bypasses Happen
Session token theft from infostealer malware bypasses MFA entirely. Attackers import stolen tokens into their browsers and authenticate as your users. Don’t rely on MFA as your only defense layer.
Build Intelligence-Driven Response
Track which ransomware groups target your industry. Understand their techniques and initial access methods. Use this intelligence to prioritize defenses and detection. Generic security doesn’t address specific threats.
Test Backup Recovery
Backups matter, but untested backups fail when you need them. Ransomware groups now target backup systems specifically. Regular recovery testing validates that you can actually restore operations under attack conditions.
Conclusion
Ransomware trends reveal a threat that’s evolving, not declining. Ransomware is present in 44% of breaches. Dark web activity increased 25% while reported incidents declined. The attacks aren’t slowing down. Detection is.
The opportunity lies in the gap between credential theft and ransomware deployment. Stolen credentials appear on dark web marketplaces days or weeks before attackers use them. That window is your chance to reset them.
Security teams that monitor these precursors can prevent attacks rather than respond to them. That means shifting investment from purely reactive endpoint detection toward proactive dark web threat intelligence.
Three steps to start:
- Scan your dark web exposure to see what credentials are already leaked
- Set up continuous credential monitoring to catch new exposures as they appear
- Monitor ransomware leak sites for your vendors and supply chain partners
Ransomware trends don’t just tell you what happened. With the right intelligence, they tell you what’s coming next.
Ransomware Trends FAQ
Ransomware operators typically purchase access rather than hack in directly. They buy stolen credentials from infostealer logs or acquire network access from initial access brokers on dark web markets. VPN and RDP credentials are especially valuable. This purchasing model means stolen credentials circulate on the dark web before attacks begin.
Infostealers capture credentials from infected devices, including VPN and RDP logins. These credentials get sold on dark web marketplaces to initial access brokers, who then sell network access to ransomware affiliates. The entire pipeline can take days to weeks, creating a detection window.
Monitor ransomware leak sites where groups announce victims and publish stolen data. Watch threat actor channels for mentions of your organization or your credentials being sold. Track initial access broker listings for your network access being advertised.
Ransomware operators prioritize VPN credentials and RDP access. Domain administrator accounts are especially valuable for lateral movement. Credentials from infostealer logs often include session tokens that bypass MFA entirely.
Prevention starts with detecting precursors. Monitor dark web markets for your credentials and reset any that appear. Patch vulnerabilities that ransomware groups actively exploit. Use unique passwords across services so one breach doesn’t expose multiple systems.
