At least this is what the Q2 incident metrics of one cybersecurity firm suggests…
Based on its incident metrics for Q2 2025, a cybersecurity firm has released some trends for its user base during that period.
The quarterly figures for ransomware incidents reflect a 43% decline in attacks compared to those in Q1. In June , the firm’s data showed a 6% decrease in attacks, with 371 recorded cases.
The slowdown follows a surge in attacks recording in the firm’s Q1 metrics, driven by aggressive campaigns from dominant ransomware groups including Clop, RansomHub, and Akira. However, with recent law enforcement efforts successfully disrupting some of these key operators, Clop and RansomHub incidents were no longer in the top 10 most active ransomware groups in the Q2 data.
Educated guesses also point to conflicts and rivalry between ransomware factions in May that could have resulted in disruption of cyberattacks, but correlation is not always causation.
Other cyber trends in Q2 2025
In terms of activity levels, Qilin was the most active ransomware group in the Q2 data, comprising 13% (151 incidents) of attacks in the data, compared to 95 incidents in Q1 2024. Other notable groups for Q2 2025 include Akira, Play, and SafePay.
- In terms of targeted groups, industrials topped the firm’s data, accounting for 30% of attacks, followed by consumer discretionary (21%), information technology (10%), healthcare (8%), and financial services (6%).
- North America remained the hardest-hit region among the firm’s customers, accounting for 58% of all global attacks (215) in June, and for 52% across Q2. Europe customer bases, on the other hand, had experienced an 8% drop in June with 21% of attacks (79). Asia had a 12% share of attacks (43), while South America followed with 4% (15).
- One last trend noted in the data was the possible political messaging by ransomware groups: The Handala group (pro-Palestine actors) had targeted 17 Israeli organizations between 14 – 30 June 2025, coinciding with the 12-day Iran-Israel war. The attacks, which commenced the day after Israel’s strikes on Iran, were likely retaliatory in nature. This possible trend could spread to other groups of attackers in future.
According to Matt Hull, Global Head of Threat Intelligence, NCC Group, the firm releasing its Q2 data analysis: “While reported ransomware incidents declined in Q2, the ecosystem remains highly volatile with new groups emerging and existing groups adapting. Organizations must maintain robust cyber defenses to stay ahead.”
