Ransomware News: Active Groups, Federal Advisories and the Latest Numbers

The FBI's IC3 logged 3,611 ransomware complaints in 2025, with reported losses over $32.3 million, and names Akira, Qilin and INC./Lynx/Sinobi as the three most-reported variants. CISA's live catalog of actively exploited vulnerabilities currently confirms ransomware use on 361 of 1,769 entries (20.4%), and its two newest named-group advisories, Gunra and SafePay, both published in 2026.

How many ransomware attacks are happening now?

IC3 received 3,611 ransomware complaints in 2025, up from 3,156 in 2024 and 2,825 in 2023, a rising trend across all three years IC3 reports. Reported losses tied to ransomware were $32,320,105 in 2025, well above the $12,473,156 reported in 2024, though both years sit below the $59,641,384 reported in 2023.

IC3 itself cautions that these figures understate the real cost: the loss total normally excludes business interruption, recovery spending and third-party remediation, and many victims never report a dollar amount to the FBI at all, which IC3 says "creates an artificially low overall ransomware loss rate."

Separately from the complaints critical-infrastructure organizations filed, IC3 received more than 1,400 ransomware complaints from businesses outside the 16 federally designated critical-infrastructure sectors, led by legal services (18% of these complaints), contracting services (17%) and engineering and architectural services (10%).

Which ransomware groups are most active?

IC3's ten most-reported ransomware variants for 2025, in order, are Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, Ransomhub, Lockbit, Dragonforce, SAFEPAY and Medusa. Together they account for 56.8% of all ransomware incidents IC3 received and over $16 million in reported losses, 49.8% of the year's total.

These top 10 variants most often hit critical manufacturing, healthcare and public health, and government facilities, the three sectors IC3 names specifically.

The list keeps turning over: IC3 identified 63 new ransomware variants via its own reporting in 2025 alone, an average of 5.25 new variants every month.

This site covers one of those ten variants, SAFEPAY, in its own dedicated entry: see SafePay ransomware: what the CISA/FBI advisory says and how to defend.

What federal advisories are newest?

CISA's own #StopRansomware advisory series named two new groups in 2026: Gunra (AA26-222A, published August 10, 2026) and SafePay (AA26-293A, published October 20, 2026), joining Ghost/Cring, Medusa, Play and Interlock, all first named in 2025.

Gunra is a ransomware-as-a-service operation that first appeared in April 2025, is believed to build on leaked Conti ransomware source code, and runs an affiliate program that launched in early 2026; its advisory lists victims across the Americas, Europe, the Middle East, Africa and Asia-Pacific in healthcare, financial services, critical manufacturing, transportation, government and several other sectors.

Gunra's advisory names FortiOS authentication-bypass flaws CVE-2024-55591 and CVE-2025-24472 as a common way in, alongside default credentials on internet-facing VPN admin accounts with no lockout control.

This site's own SafePay entry already covers that advisory's entry routes, lateral-movement tooling and extortion method in full.

How many actively exploited vulnerabilities tie to ransomware?

CISA's Known Exploited Vulnerabilities (KEV) catalog, fetched directly for this page, flags 361 of its current 1,769 entries (20.4%) as having confirmed ransomware campaign use. That is this network's own cross-reference, not a figure CISA publishes as a single number; it comes from reading CISA's own "Known Ransomware Campaign Use" field across the full live catalog, the same field this site's must-patch tracker and exploit-lag tracker read daily.

The current 45-day /must-patch window, the vulnerabilities CISA added most recently, shows none of today's 48 entries flagged "Known": CISA's own schema defines "Unknown" as meaning it lacks confirmation of ransomware use, not that ransomware use has been ruled out, so a flaw can graduate from "Unknown" to "Known" later as more incident reporting comes in. See the full catalog tracker, /kev, for the complete, continuously updated list.

What should security teams prioritize first?

The FBI's own mitigation list, repeated across its 2025 report and its #StopRansomware guidance, leads with patching: "Prioritize patching known exploited vulnerabilities in internet-facing systems," alongside offline, encrypted and immutable backups covering the whole organization, removing default credentials, enforcing least privilege on administrative accounts, multi-factor authentication on remote-access and webmail systems, and network segmentation to limit lateral movement once an intruder is inside.

CISA's own stopransomware.gov page states the same aim more plainly: ransomware is "a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable," and its first listed tip is to "conduct regular vulnerability scanning to identify and address vulnerabilities" before an attacker finds them first.

FAQ

Is ransomware increasing in 2026?

IC3's complaint count rose every year from 2023 (2,825) to 2024 (3,156) to 2025 (3,611), a sustained increase, though reported dollar losses moved the other way: 2025's $32.3 million is far below 2023's $59.6 million, so complaint volume and reported loss totals have not moved in the same direction.

What is the most common ransomware right now?

IC3's 2025 data ranks Akira first, followed by Qilin and INC./Lynx/Sinobi, among the ten variants that together made up 56.8% of reported ransomware incidents that year.

How much money is lost to ransomware each year?

IC3 recorded $32,320,105 in reported ransomware losses for 2025, a figure IC3 itself says is likely understated since it excludes business interruption, recovery costs and unreported incidents.

What are the newest ransomware advisories from CISA?

SafePay (AA26-293A, October 20, 2026) and Gunra (AA26-222A, August 10, 2026) are CISA's two newest #StopRansomware joint advisories as of this page, each naming a specific ransomware-as-a-service group, its targets and its entry methods.

How many actively exploited vulnerabilities are tied to ransomware?

CISA's live KEV catalog currently flags 361 of 1,769 entries (20.4%) with confirmed ransomware campaign use, based on this site's own direct read of CISA's catalog data.

See /must-patch for the current actively exploited vulnerability window, /kev for the full KEV catalog tracker, /exploit-lag for how long a flaw was known before CISA confirmed exploitation, the security glossary's ransomware entry for the term defined from NIST's own framework, and reading CISA KEV alerts for ransomware-use signals for how to turn a single KEV alert into a response decision.