Ransomware attacks on the information technology sector rose in every quarter of 2025 compared with the same quarter a year earlier, according to a new report from the Information Technology Information Sharing and Analysis Center. The sector recorded 746 attacks for the year, more than double 2024's total, and ranked third among targeted industries behind manufacturing and commercial facilities. Close to half of the IT-sector attacks the group tracked struck organizations in the United States, far ahead of any other country.
The center attributed the increase to what it called a strategic pivot toward the IT sector, with ransomware gangs exploiting weaknesses in software supply chains. "While defensive capabilities may have improved, attackers countered with record-breaking speed, weaponizing critical zero-day vulnerabilities in platforms within hours of disclosure," the IT-ISAC said in its report. Living-off-the-land techniques and sharper social engineering also helped attackers slip past defenses, the group said.
Across all critical sectors, the joint tracking effort run by the IT-ISAC and the Food and Ag-ISAC recorded about 6,377 ransomware attacks in 2025, an 82% jump from 3,508 the year before. Manufacturing was the most targeted industry, with 1,440 attacks, followed by commercial facilities with 1,107 and the IT sector with 746. Healthcare, financial services and the legal sector rounded out the top six. Just over half of all attacks tracked worldwide struck organizations in the United States; no other country topped 300.
Two groups, Qilin and Cl0p, displaced RansomHub and Akira as the most active ransomware operators of the year. Qilin, which runs as a ransomware-as-a-service business, adopted a Rust-based encryption tool that lets it target multiple operating systems efficiently. Cl0p "remains a top-tier threat" because of its focus on high-volume exploitation of zero-day flaws, according to the IT-ISAC.
A companion report, titled "Farm-to-Table Ransomware Realities," tracked the food and agriculture sector separately and counted 265 attacks in 2025, or 4.2% of the total volume across all sectors. "While the attack rate was lower than in other sectors, the number of victims increased," the Food and Ag-ISAC wrote. Five groups, Qilin, Akira, Cl0p, Play and Lynx, led the campaigns against the sector and together accounted for nearly half of its incidents.
Most gangs hitting food and agriculture companies appear to be "looking for victims of opportunity, rather than targeting the sector specifically," the Food and Ag-ISAC said. Cl0p is the exception: 9.3% of its 2025 attacks targeted the sector, more than double the 4.2% average share across all groups tracked.
Researchers behind the food and agriculture report expect the threat to keep fragmenting rather than ease. The number of distinct ransomware groups grew by nearly 50% in 2025, and affiliates are increasingly gravitating toward smaller, shorter-lived collectives that are harder for law enforcement to track before they rebrand.
Leave a Reply