Check Point Research (CPR), the security researchers at Check Point® Software Technologies Ltd., a pioneer and leading provider of cyber security solutions, has released its Ransomware Report for Q2 2025.

Sergey Shykevich, Threat Intelligence Group Manager at Check Point Software Technologies, summarises: “In Q2 2025, we observed a significant change in the ransomware landscape: less dominant RaaS groups, a decline in published victims and more sophisticated extortion tactics. As hackers adapt their respective ransomware to a now fragmented ecosystem, we expect to see more aggressive negotiation strategies and an increasing reliance on AI to automate and improve all phases of the attack.”

Highlights of the report:

• Large ransomware-as-a-service (RaaS) groups collapsed, such as LockBit and RansomHub, leading to fragmentation of the criminal ecosystem.
• The rise of AI in phishing, negotiation bots and affiliate-driven cartel models (such as DragonForce).
• Ransomware gangs are moving away from encrypting critical data and increasingly turning to theft and (threatened) publication.
• The number of publicly named victims fell by six percent, indicating more covert operations by hackers.

Security researchers have also observed that ransomware groups are increasingly copying company logos and offering white-label services, i.e. a blank kit for criminal customers. They are even going so far as to enter into partnerships with Ramp, the leading underground forum for ransomware.

All details here: Check Point Ransomware Report Q2 2025