Ransomware Quarterly Reports
Ransomware threats are constantly evolving.
Learn more about ransomware trends through Coveware's quarterly ransomware reports. The data is collected first-hand from Coveware's Incident Response team. The report also aggregates important statistics such as ransom demands and attack vectors.
April 30, 2026
Patch management goes from hard, to ludicrous in the agentic AI era
The release of agentic AI is compressing the nature of patch management and how defenders must prepare for the future of cyber attacks. This is increasing pressure on patch velocity, compensating controls, and dependency visibility.
February 3, 2026
Why Zero-Day Downstream Mass Data Extortion Campaigns are Losing Their Bite
Are we seeing the extinction of mass data exfiltration campaigns? The stats demonstrate these attacks are losing their efficacy.
October 24, 2025
Insider Threats Loom while Ransom Payment Rates Plummet
The percentage of companies choosing to pay ransoms dropped significantly, while threat actors shift their tactics in response to decreasing profits.
July 23, 2025
Targeted social engineering is en vogue as ransom payment sizes increase
Several ransomware groups used highly targeted social engineering tactics to create a major impact across several industry sectors in Q2 2025.
May 1, 2025
The organizational structure of ransomware threat actor groups is evolving before our eyes
The Ransomware-as-a-service (RaaS) model has not recovered from law enforcement disruption, and the entrance of novice actors along with non-Russian state-linked cybercriminals has led to uncertain outcomes for victims.
February 4, 2025
Will Law Enforcement success against ransomware continue in 2025?
2024 was a banner year for Law enforcement agency actions against ransomware and cybercrime groups. Will the new administration ensure this momentum continues?
November 1, 2024
Law enforcement doxxing raises risk profile for threat actors
In Q3 2024, Law enforcement actions disrupted infrastructure and publicized the identity of several prolific ransomware threat actors.
July 30, 2024
Ransomware actors pivot away from major brands in Q2 2024
Unaffiliated ‘lone wolf’ threat actors carry out a greater share of attacks as they attempt to obfuscate their identity in Q2 2024.
April 17, 2024
RaaS devs hurt their credibility by cheating affiliates in Q1 2024
RaaS developers were caught cheating their affiliates, shaking the trust in the RaaS model following several high profile law enforcement actions.
January 26, 2024
New Ransomware Reporting Requirements Kick in as Victims Increasingly Avoid Paying
A lower percentage of ransomware victims are paying, as new regulations begin to elicit more and more public disclosure of ransomware incidents.
October 30, 2023
Scattered Ransomware Attribution Blurs Focus on IR Fundamentals
In Q3 2023, a series of ransomware attacks by similar threat actors created headlines and blurred the lines of attribution.
July 21, 2023
Ransom Monetization Rates Fall to Record Low Despite Jump In Average Ransom Payments
As ransomware affiliates are paid less frequently, they have adapted their strategies to compensate for the shifting dynamics of cyber extortion.
April 28, 2023
Big Game Hunting is back despite decreasing Ransom Payment Amounts
Ransomware threat actors are moving back up-market in search of lost profits as the cyber extortion economy seeks to halt its contraction.
January 20, 2023
Improved Security and Backups Result in Record Low Number of Ransomware Payments
Only 37% of ransomware victims paid a ransom in Q4, a record low as security and backup continuity investments pay off.
October 26, 2022
Uber Verdict Raises New Risks for Ransom Payments
The conviction of a high profile security executive who paid to suppress a data leak has created a new dimension of risk for security executives.
July 28, 2022
Fewer Ransomware Victims Pay, as Median Ransom Falls in Q2 2022
Ransomware actors became more fluid in Q2 2022 as attribution becomes harder, and fewer victims succumb to paying cyber criminals.
May 3, 2022
Ransomware Threat Actors Pivot from Big Game to Big Shame Hunting
Less Victims of Ransomware are Paying, even as Cybercriminals Shift from Big Game to Big Shame Hunting.
February 3, 2022
Law enforcement pressure forces ransomware groups to refine tactics in Q4 2021
Ransomware as a service groups are shifting their tactics as enterprises become harder targets, and law enforcement pressure mounts.
October 21, 2021
Ransomware attackers down shift to 'Mid-Game' hunting in Q3 2021
Ransomware attacks continued to proliferate in Q3 as governments and law enforcement ratchet up the pressure of the cyber extortion economy.
July 23, 2021
Q2 Ransom Payment Amounts Decline as Ransomware becomes a National Security Priority
Ransomware payment amounts declined in Q2 as several high profile attacks escalated the attention of the US government and law enforcement.
April 26, 2021
Ransomware Attack Vectors Shift as New Software Vulnerability Exploits Abound
Ransomware attacks continued to proliferate in Q1 2021 as several common but unpatched software vulnerabilities created a fresh supply of compromised network access to ransomware affiliates.
February 23, 2021
Q4 2020 Doxxing Victim Trends: Industrial Sector Emerges as Primary Ransom “Non-Payor”
See how doxxing victims are distributed across industries, company sizes, and revenue tiers. Find Coveware’s data and analysis on doxxing trends in Q4.
February 1, 2021
Ransomware Payments Fall as Fewer Companies Pay Data Exfiltration Extortion Demands
Coveware’s Q4 Ransomware Report finds that fewer companies are paying criminal extortionists that are holding stolen data for ransom.
November 4, 2020
Ransomware Demands continue to rise as Data Exfiltration becomes common, and Maze subdues
Ransomware attacks in Q3 2020 were marked by a larger reliance on stolen data. During the quarter, Maze sunset their operations while Ryuk restarted their campaign.
August 3, 2020
Ransomware Attacks Fracture Between Enterprise and Ransomware-as-a-Service in Q2 as Demands Increase
During the first quarter of 2020 ransomware threat actors took advantage of the economic and workplace disruption caused by the COVID-19 outbreak. A proliferation of new variants were observed as some regular ransomware types began to fade. Read on!
April 29, 2020
Ransomware Payments Up 33% As Maze and Sodinokibi Proliferate in Q1 2020
January 23, 2020
Ransomware Costs Double in Q4 as Ryuk, Sodinokibi Proliferate
Ransom demands more than doubled between Q3 and Q4 of 2019, as multiple variants gained broader distribution amongst enterprises large and small.