Cl0p leads record-breaking ransomware surge in Q1 2025
A new Check Point report shows ransomware cases surged by 126% in early 2025, led by Cl0p's zero-day attacks. New players like RansomHub and AI-aided FunkSec are using fake leaks and data extortion tactics to climb fast. Tracking real threats is now harder than ever.
Something big is going on in ransomware land, and the numbers from Q1 2025 are just wild. A new report by Check Point Research reveals a record-breaking 126% year-on-year surge in publicly named ransomware victims. In total, 2,289 cases were claimed by 74 different groups. That’s more than double the number from the same time last year.
Cl0p leads the charge with zero-day attacks
Let’s start with the big villain of the quarter, Cl0p. The group resurfaced with 392 public victims, making it the most active ransomware actor this year so far. And they didn’t even bother encrypting anything.
The ransomware map: US leads, UK and Germany in focus
Unsurprisingly, the US remains the top target, with half of all reported victims. The UK saw a unique spike from the Medusa group, responsible for 9% of its attacks. In Germany, Safepay led the list, tied to 24% of all ransomware incidents in the country.
Fabrication frenzy and data extortion trends
There’s also a growing problem with credibility. Groups now often post fake victim names or re-share old leaks to appear more dangerous. It’s a trend that started with LockBit and is now used by many, especially Babuk-Bjorka.
And as encryption becomes less popular, pure data extortion is rising. Victims often don’t even realise they’ve been hacked until their data shows up on a leak site.
Check Point’s report warns that these new tactics make it harder to track real attack volume. For example, despite the jump in reported victims, Chainalysis found a 35% drop in actual crypto payments to ransomware actors. That suggests either fewer real breaches or just better bluffing.
This surge, mixed with AI tooling, fake victims, and a rise in quick-and-dirty data extortion, is reshaping the ransomware game and not for the better.
 And here’s the twist, that doesn’t even count the hidden ones. Many companies that quietly pay up are never even listed on leak sites. Which means these numbers? Just the tip of the iceberg.
Read More: