December 2025 Threat Trend Report on Ransomware
This report provides the number of affected systems confirmed during December 2025, DLS-based ransomware-related statistics, and notable ransomware issues in Korea and abroad. Below is a summary of some information.
The statistics on the number of ransomware samples and affected systems are based on the diagnostic names assigned by AhnLab. Please note that the statistics on affected companies are based on the information publicly available on the DLS (Dedicated Leak Sites, equivalent to what is referred to as ransomware PR sites or PR pages) of the ransomware groups and were collected by the ATIP infrastructure.
Beginning with the December 2025 reporting period, the aggregation method for ransomware victim organization statistics has been updated. As a result, caution is advised when directly comparing monthly statistics from reports published before December 2025.
Summary of Statistics
The following are the four statistics provided in the report. The AhnLab SEcurity intelligence Center (ASEC) blog only provides the trend statistics of “Ransomware Detections and Statistics (Past 3 Years)” and the other statistics are available in the report attached to AhnLab TIP.
- Top 10 Countries by Ransomware Group (December 2025)
- Industries of companies affected by ransomware groups (December 2025)
- Trend of Top 10 Ransomware Groups in the Last 3 Years
- Ransomware DLS and Detection Statistics (Last 3 Years)
Key Issue Summary
In December 2025, ransomware groups launched attacks targeting various industries worldwide. Attacks targeting critical infrastructure facilities, such as manufacturing, healthcare, and finance were particularly notable. Alongside the emergence of new ransomware groups, existing groups also continued their active operations.
The AhnLab TIP report covers the following topics: the main ransomware groups and their trends, and the industries and regions affected by ransomware.
- Trends of Major Ransomware Groups (Qilin,LockBit 5.0, Everest,etc.)
- Damage Trend by Industry
- Regional Damage Trends
- New Threat Trends
