Ransomware Surges as Attempts Spike 146% Amid Aggressive Extortion Tactics

Rhea-AI Summary

Zscaler (NASDAQ: ZS) has released its annual ThreatLabz 2025 Ransomware Report, revealing a dramatic 146% surge in ransomware attacks blocked by their cloud platform. The report highlights a significant shift in attack strategies, with threat actors increasingly focusing on data extortion over encryption. Key findings show that ransomware groups stole 238 TB of data, representing a 92% increase year-over-year.

The report identifies Manufacturing, Technology, and Healthcare as the most targeted sectors, with the Oil & Gas industry experiencing a remarkable 935% increase in attacks. The United States remains the primary target, accounting for 50% of all attacks with 3,671 incidents. RansomHub emerged as the most active group with 833 publicly named victims, followed by Akira (520) and Clop (488).

Positive

• None.

Negative

• 146% increase in ransomware attacks indicates growing security challenges
• 92% surge in data exfiltration volume suggests escalating threat severity
• Emergence of 34 new ransomware families shows rapidly evolving threat landscape

Insights

Cybersecurity Analyst

Zscaler's threat report reveals alarming 146% ransomware surge, positioning their Zero Trust platform as critical in the evolving threat landscape.

Zscaler's ThreatLabz 2025 Ransomware Report highlights a dramatic 146% year-over-year increase in ransomware attacks, the steepest spike observed in three years. This surge represents a strategic shift in threat actor tactics, with ransomware groups now prioritizing data exfiltration and extortion over traditional encryption methods. The 92% increase in exfiltrated data volume (from 123TB to 238TB) demonstrates attackers are increasingly weaponizing stolen information to pressure victims.

The report identifies Manufacturing (1,063 attacks), Technology (922), and Healthcare (672) as the most targeted sectors, with Oil & Gas experiencing a staggering 935% increase in attacks year-over-year. This targeting pattern reveals how threat actors are strategically focusing on industries where operational disruption, data sensitivity, and regulatory concerns create maximum leverage.

The United States faces 50% of all ransomware attacks (3,671 incidents), more than all other top-15 targeted countries combined. The report also identifies RansomHub, Akira, and Clop as the most prolific threat groups, with 34 new ransomware families emerging in the past year.

This data underscores the growing sophistication of threat actors and highlights Zscaler's strategic position in the cybersecurity ecosystem. Their Zero Trust Exchange platform, which replaces traditional network-centric security models with a cloud-native architecture, aims to counter ransomware at multiple attack stages by minimizing attack surfaces, preventing initial compromise, eliminating lateral movement, and blocking data exfiltration.

For Zscaler, this threat landscape evolution represents both a challenge and opportunity. As ransomware threats intensify and adapt, demand for comprehensive security solutions like Zscaler's Zero Trust Exchange platform is likely to grow, particularly among the heavily-targeted sectors identified in the report.

Zscaler’s Annual ThreatLabz Report Reveals Key Ransomware Groups Stole 238 TB of Data in One Year

Key Findings:

• Ransomware attacks blocked by the Zscaler cloud rose 146%, the sharpest spike observed in the past three years.
• Public extortion cases jumped by 70% based on data leak site analysis.
• Data exfiltration volumes increased 92%.
• Manufacturing, Technology, and Healthcare were the top targeted industries, and the Oil & Gas sector experienced a 935% increase in attacks.
  
  

SAN JOSE, Calif., July 29, 2025 (GLOBE NEWSWIRE) -- Zscaler, Inc. (NASDAQ: ZS), the leader in cloud security, today published its annual Zscaler ThreatLabz 2025 Ransomware Report. The report examines the latest trends shaping the ransomware threat landscape, revealing how attacks are adapting and escalating. It highlights the most targeted sectors and regions, profiles the most active ransomware families, analyzes shifting attack methodologies, and provides actionable recommendations to help organizations strengthen their defenses. ThreatLabz’s findings underscore the critical importance of organizations adopting a comprehensive Zero Trust Everywhere strategy. This approach is essential to prevent ransomware and other malicious threats from lateral movement and compromising sensitive user data, applications, and information.

"Ransomware tactics continue to evolve, with the growing shift toward extortion over encryption as a clear example," said Deepen Desai, EVP Cybersecurity, Zscaler. "GenAI is also increasingly becoming part of the ransomware threat actor's playbook, enabling more targeted and efficient attacks. As threats advance, security measures must keep pace. The Zscaler Zero Trust Exchange™ platform empowers organizations to shrink their attack surface, identify and block initial compromise threats, prevent lateral movement, and stop data exfiltration to shut down extortion events before they happen."

Data Demand Fuels Steady Attack Growth
Ransomware attacks are intensifying at an alarming rate, with attempted attacks blocked in the Zscaler cloud up 146% year-over-year. This escalation reflects a strategic shift: ransomware groups are increasingly prioritizing extortion over encryption. Accordingly, the report details a 92% increase in the total volume of exfiltrated data by 10 major ransomware groups in the past year, rising from 123 TB to 238 TB. This emphasis on data theft—and the threat of exposure—allows attackers to exert greater pressure on victims, amplifying the impact of ransomware on organizations globally.

Industries Under Siege
Cybercriminals continue to focus on the high-stakes environments of the Manufacturing (1,063 attacks), Technology (922), and Healthcare (672) sectors, making them the most frequently hit by ransomware over the past year. These industries are particularly vulnerable due to the potential for operational disruption, the sensitivity of stolen data, and the associated risks of reputational damage and regulatory fallout.

The Oil & Gas sector has seen a staggering increase in ransomware attacks, spiking over 900% year-over-year. This surge is likely a result of increased automation of systems that control critical infrastructure, including drilling rigs and pipelines, expanding the sector’s attack surface, coupled with outdated security practices.

United States Is the Target of Half of All Ransomware Attacks
Leak site data highlights a distinct geographic disparity, with victims in the United States accounting for 50% of ransomware attacks, significantly outpacing Canada (5%) and the United Kingdom (4%). Ransomware attacks in the U.S. more than doubled to 3,671, exceeding the combined total number of attacks reported across all other countries in the top 15 most-targeted countries. This concentration demonstrates how threat actors continue to strategically target digitally concentrated, high-value economies.

Ransomware Groups Driving the Surge
Several highly active groups continued to dominate the ransomware ecosystem, with RansomHub leading the pack, claiming the highest number of publicly named victims at 833. Akira and Clop have both moved up in the ransomware attack rankings since last year. Akira, associated with 520 victims, has steadily expanded its reach through numerous affiliates and initial access brokers. Clop, known for its focus on supply chain attacks, is close behind with 488 victims, employing an effective strategy of exploiting vulnerabilities in commonly used third-party software.

Zscaler ThreatLabz identified 34 newly active ransomware families over the past year, bringing the total number tracked to 425 since their research began, and has a public GitHub repository that now hosts 1,018 ransomware notes, with 73 added in the last year.

How Zscaler Stops Ransomware with Zero Trust + AI
Ransomware flourishes in environments with fragmented security, limited visibility, implicit trust, and outdated legacy architectures that amplify risk rather than reduce it. The Zscaler Zero Trust Exchange mitigates these risks by replacing traditional, network-centric models with a cloud-native, AI-driven zero trust architecture, and stops ransomware at every stage of the attack life cycle by:

• Minimizing the attack surface
• Preventing initial compromise
• Eliminating lateral movement
• Blocking data exfiltration
  
  

Additional AI-powered ransomware protections from Zscaler include:

• Breach prediction
• Phishing and C2 detection
• Inline sandboxing
• Zero Trust Browser
• Segmentation
• Dynamic, risk-based policy
• Data discovery and classification
• Data loss prevention (DLP) controls
  
  

Download the Report
Get the full ThreatLabz 2025 Ransomware Report to explore how Zscaler ThreatLabz plays an active role in protecting enterprises worldwide. Download today.

Research Methodology
The research methodology for this report is a comprehensive process that uses multiple data sources to identify and track ransomware trends. The ThreatLabz team collected data between April 2024 and April 2025 from sources including the Zscaler global security cloud, and the team’s own analysis of ransomware samples and attack data.

About ThreatLabz
ThreatLabz is the security research arm of Zscaler. This world-class team is responsible for hunting new threats and ensuring that the thousands of organizations using the global Zscaler platform are always protected. In addition to malware research and behavioral analysis, team members are involved in the research and development of new prototype modules for advanced threat protection on the Zscaler platform, and regularly conduct internal security audits to ensure that Zscaler products and infrastructure meet security compliance standards. ThreatLabz regularly publishes in-depth analyses of new and emerging threats on its portal, research.zscaler.com.

About Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange™ platform protects thousands of customers from cyberattacks and data loss by securely connecting users, devices, and applications in any location. Distributed across more than 160 data centers globally, the SASE-based Zero Trust Exchange is the world’s largest in-line cloud security platform.

Media Contact:
Nick Gonzalez
press@zscaler.com

A photo accompanying this announcement is available at https://www.globenewswire.com/NewsRoom/AttachmentNg/b92c9822-3941-45ec-8aa1-87defcd57281

FAQ

What is the percentage increase in ransomware attacks according to Zscaler's (ZS) 2025 report?

According to Zscaler's report, ransomware attacks blocked by their cloud platform increased by 146% year-over-year, marking the sharpest spike in three years.

How much data did ransomware groups steal according to Zscaler's (ZS) 2025 report?

Ransomware groups stole 238 TB of data in the past year, representing a 92% increase from the previous year's 123 TB.

Which industries were most targeted by ransomware attacks in 2025 according to Zscaler?

The most targeted industries were Manufacturing (1,063 attacks), Technology (922), and Healthcare (672). The Oil & Gas sector saw the highest growth with a 935% increase in attacks.

Who are the most active ransomware groups in 2025 according to Zscaler's report?

RansomHub led with 833 publicly named victims, followed by Akira with 520 victims and Clop with 488 victims.

What percentage of ransomware attacks targeted the United States in Zscaler's 2025 report?

The United States accounted for 50% of all ransomware attacks, with 3,671 incidents, exceeding the combined total of all other countries in the top 15 most-targeted list.