Total ransomware payments dropped 8% to $820M in 2025 amid a 50% rise in attacks; median ransom rose 368% to nearly $60,000. Criminals and state-linked entities share infrastructure. Law enforcement disrupts enabling services rather than just targeting groups. Ransomware incidents increasingly affect critical infrastructure, and Initial Access Brokers facilitate these attacks. While revenue declines, the complexity and impact of attacks increase, necessitating robust defenses against evolving methods.
