Ransomware Trends In 2025
KnowBe4, Tuesday, July 22nd, 2025
I've been following ransomware since the first one, the AIDS Cop Trojan, was released in December 1989. It locked up victim computers and asked for $300 to be sent to a Panama P.O. Box. A lot has changed since then.
The invention of cryptocurrencies, particularly Bitcoin in January 2009, was largely responsible for the explosion of ransomware by 2013. This was when CryptoLocker ransomware was released to the world. Ransomware gangs have been making many billions of dollars per year ever since.
The 'double extortion' phase of ransomware, where ransomware gangs first exfiltrated data and logon credentials, started in November 2019. Now, well over 90% of ransomware exfiltrates data. Forty percent (40%) of ransomware gangs only do data exfiltration (without the encryption threat) to get paid.