Key Findings Disappearance of significant RaaS groups Several prominent RaaS groups, including RansomHub, Babuk-Bjorka, FunkSec, BianLIan, 8Base, Cactus, Hunters International, and Lockbit, stopped publishing new victims. Though the reasons for their disappearances vary, the net effect is a fragmented ransomware ecosystem no longer dominated by one or two major players. Decline in publicly posted victims Q2 2025 saw a drop of 6% in the number of victims listed on ransomware Data Leak Sites, compared to the monthly average during the last 12 months. This decline is likely driven by continued global law enforcement efforts, a drop in victims’ willingness to pay, and strategic shifts by ransomware operators to reduce risk exposure. Qilin – the new leader introduces innovative extortion…