Skip to content
Strengthen Your Digital Fortress — Unveil the Latest Gadgets

Ransomware Activity Plummets in April 2025 as RansomHub Falters

RansomHub's infrastructure issues and lack of new victims led to a significant decrease in ransomware activity in April. Meanwhile, Qilin's rise could be due to new affiliates.

,   and  Administrator
1 min read
In the image there are a group of people standing on the floor in a room and in front of them there...
In the image there are a group of people standing on the floor in a room and in front of them there is a lot of equipment and all of them were wearing ID cards and holding some files and cameras, in the background there is a wall.

Ransomware Activity Plummets in April 2025 as RansomHub Falters

Ransomware news saw a significant decline in April 2025, following a peak in March. One of the leading groups, RansomHub, experienced infrastructure outages and a lack of new victims, contributing to the decrease. Meanwhile, the Qilin ransom group's activity increased, potentially due to affiliates from other groups moving over.

Comparitech logged 479 ransomware attacks in April, down from 530 in January, 973 in February, and 713 in March. Notably, 39 out of these April attacks were confirmed by the targeted entities. RansomHub, which was one of the most prolific groups in March with 62 claimed attacks, suffered a significant outage on March 31. This, coupled with no new victims listed on their data leak site in April, contributed to their reduced news activity.

The Qilin ransom group emerged as the most prolific in April, followed by Akira, Play, Lynx, and NightSpire. Interestingly, there were reports of a possible split within the Lazarus group, with one faction allegedly joining Qilin. This shift could also have contributed to the changing landscape of ransomware news. UK retailer Marks & Spencer was also linked to a high-profile ransomware attack involving the notorious Scattered Spider group during this period.

In summary, April 2025 saw a significant decline in ransomware news, with RansomHub's outages and reduced activity contributing to this decrease. Meanwhile, Qilin emerged as the most active group, potentially boosted by new affiliates. The shifting dynamics among ransomware groups, as seen with the possible Lazarus split, highlight the ever-evolving nature of cyber threats.

Read also:

Related

Latest