← Artículos y guías sobre fraude, ciberseguridad, privacidad y PLD
Ransomware 2025–2026: most active gangs, top countries and Brazil
2025 set records for ransomware victims and active gangs, with Qilin on top. See the most targeted countries, where Brazil ranks and what surveys show.
Ransomware, which locks systems or steals data and demands payment, had its most intense year on record in 2025. Methodologies vary, but they agree on direction. Searchlight Cyber counted 7,458 victims on leak sites and 124 active groups, 73 of them new, per TechRadar. NTT Data counted 8,159; GuidePoint recorded a 58% increase and a record Q4 2025 with 2,287 victims.
Most active groups
Qilin dominated with 946 victims (NTT) or 1,044 (GuidePoint), followed by Akira with 717. Cl0p, Play, INC Ransom, SafePay, Lynx, RansomHub, DragonForce and Babuk2 completed NTT's top 10. In December 2025, Check Point put Qilin at 18% of victims, LockBit 5.0 at 12% and Akira at 7%; that month saw 945 victims (+60% year on year), 52% in North America.
Most targeted countries and Brazil
The US leads by far: 1,536 victims in 2025 by Searchlight's count (Ransomware.live: 3,926), followed by Canada (182), Germany (167) and the UK (131).
- ISH Tecnologia counted 7,410 confirmed corporate victims worldwide (+17.8%) and ranked Brazil 9th globally, per Estado de Minas.
- In June 2026, Ransomware.live ranked Brazil 3rd with 23 victims, behind the US (199) and Germany (49); Mexico had 14, per TI Inside.
- Kaspersky blocked 549,000 ransomware attempts in Brazil between August 2024 and June 2025 (+12%), more than half of Latin America's total.
Monthly 2026 data from Ransomware.live show a high, steady pace: 702 victims in January, 870 in April and 708 in June.
To pay or not to pay
| Indicator | Global (Sophos 2025) | Brazil (Sophos 2026) |
|---|---|---|
| Median ransom | $1m paid (2024: $2m) | $640k demanded (2025: $392.5k) |
| Recovery cost, excl. ransom | $1.53m | $1.05m |
| Paid and recovered data | ~50% paid | 45% (2025: 66%) |
In Brazil, malicious email was the root cause in 37% of cases, the highest among all countries in the Sophos study. The Verizon DBIR 2025 found ransomware in 88% of SMB breaches, with a median paid ransom of $115,000.
Reducing the risk
- Train staff against malicious email and phishing.
- Patch edge devices and VPNs, an increasingly common entry point.
- Enforce multi-factor authentication on remote and admin access.
- Keep isolated, tested backups: being able to restore is what lets you refuse to pay.
- Prepare a response plan including regulator notification deadlines.
Fuente
- TechRadar / Searchlight Cyber: ransomware H2 2025
- Picus Security / NTT Data: top 10 ransomware groups of 2025
- GuidePoint Security: GRIT 2026 Report
- Estado de Minas / ISH Tecnologia: ransomware avança 17,8%
- IT Edge News / Check Point: dezembro de 2025
- TI Inside / Ransomware.live: Brasil entre os 10 países
- Hardware.com.br / Kaspersky: Brasil é alvo número 1 na América Latina
- Sophos: State of Ransomware 2025
- Sophos: State of Ransomware in Brazil 2026
- FBI IC3, 2025 Internet Crime Report (cópia do PDF, Finsiders)
- Mayer Brown: ANPD data breach notification regulation
- Verizon DBIR 2025 (press release via Officer.com)