Recent Ransomware Attacks

Ransomware Basics

Ransomware is one of the most common and fastest-evolving cyberthreats to organizations. CISA defines it as “an ever-evolving form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable”. To recover these locked files, you need a digital key (decryptor) that the attacker promises to provide – but only if you cough up the ransom. Unfortunately, not all attackers keep their promises: in 2024, 84% of victims paid ransoms but only 47% got their data back uncorrupted.

Early “lockerware” variants of ransomware locked victims out of their machines. These evolved into variations that encrypted victims’ files and displayed a ransom note on the locked device. From such indiscriminate, “spray and pray” tactics, ransomware attacks have evolved into highly sophisticated campaigns designed to yield high payouts and often targeting specific industries or organizations, such as government entities, critical infrastructure providers, private sector firms, and educational institutions.

Many attackers have also adopted “double-extortion” techniques in which they not only encrypt data, but also threaten to sell, leak, or publish the exfiltrated data if the victim doesn’t pay up. The growth of “ransomware-as-a-Service” (RaaS) makes it even easier for adversaries to distribute devastating ransomware strains and execute large-scale attacks at will.

Did you know?

•  In 2024, 16.3% of organizations that were hit by ransomware were forced to pay ransoms to recover their data (up from 6.9% in 2023).
• Ransomware payments skyrocketed to record highs, with total payments of $459.8 million.
• The average ransom demand per attack exceeded $5.2 million in just H1 2024.
• The average attack cost was $4.91 million, making ransomware the third-costliest cyberattack of 2024.
• 46% of security professionals estimate that their organizations suffered losses of $1-10 million in terms of ransom fees, lost revenues, and brand damage.
• 78% of organizations attacked in 2023 were breached again in 2024; 63% of these were asked to pay even higher ransoms the second time.
• In 2024, 56% of attacked organizations didn’t detect a ransomware breach for 3-12 months, indicating a low level of awareness and preparedness to this threat.
• Also, only 22% of attacked organizations recovered from an attack within a week, indicating a worrying increase in recovery times.
• Organizations with good cybersecurity hygiene have a 35X lower frequency of experiencing destructive ransomware events, which shows that hygiene plays an important role in reducing the impact of ransomware attacks.

Ransomware Threats and Incidents Continue in 2025

Ransomware remains a common, global cyberthreat in 2025, with thousands of organizations hit, particularly in the healthcare, education, local government , and critical infrastructure sectors. That said, organizations in every industry are vulnerable to this growing threat so it’s crucial for them to take measures to prevent attacks and protect their assets and data. One important measure is to implement a reliable ransomware detection and response solution like SpinRDR. Check out this guide to learn how you can choose the right solution for your organization!