Law Enforcement Pressure Is Reshaping The Global Ransomware Threat Landscape
Security Boulevard, Wednesday, October 8th, 2025
Check Point's quarterly Ransomware Report reveals dramatic changes in the global ransomware landscape. In Q2 2025, once-dominant ransomware-as-a-service (RaaS) groups, including Lockbit and RansomHub, either ceased operations or stopped publishing victim data altogether.
Their abrupt disappearance fractured an ecosystem that had long been controlled by a few powerful players. In their place emerged a fragmented and volatile array of smaller, agile actors eager to fill the void.
The shift was not by chance. Law enforcement has been under increased pressure to investigate and apprehend the operators of the most notorious ransomware groups and their efforts have started to pay dividends.