On International Anti-Ransomware Day, May 12, Kaspersky shares a report with an overview of ransomware trends that marked 2025 and insights into what the threat landscape holds in 2026.

According to Kaspersky Security Network, in 2025 Latin America had the highest share of organisations with ransomware attacks detected (8.13%), followed by the Asia-Pacific region (7.89%), Africa (7.62%), Middle East (7.27%), the Commonwealth of Independent States (CIS, 5.91%) and Europe (3.82%).

The report highlights the rise of “encryption-less” extortion attacks, the use of post-quantum cryptography by ransomware groups, and the persistent use of Telegram channels by cybercriminals to distribute compromised data sets and credentials.

Despite a slight decline in the overall share of organisations attacked by ransomware in 2025 compared to 2024, users remain at significant risk as attackers industrialise their operations, automate intrusion methods, and increasingly focus on stealing and leaking sensitive data rather than simply encrypting systems.

One of the trends in 2025 is the continued rise of endpoint detection and response (EDR) “killers” – tools specifically designed to disable endpoint security solutions before executing the malware itself. EDR killers have become a standard component of attacks, which means more deliberate and methodical intrusions.

Researchers also noted the emergence of ransomware families adopting post-quantum cryptography standards – this was predicted by Kaspersky previously. The development signals a concerning shift toward encryption methods that could resist future quantum computing decryption attempts.

The role of Initial Access Brokers (IABs) – cybercriminal intermediaries that sell pre-compromised corporate access through underground forums and messaging platforms – is growing. RDWeb portals (websites through which devices can be controlled remotely) are increasingly targeted as ransomware groups continue to industrialise attacks through “Access-as-a-Service” operations. As a result, the barrier to launching ransomware attacks declines.

Telegram channels and dark web forums continuously function as platforms for the distribution and for the sale of compromised data sets and accesses including those that were obtained as a result of ransomware attacks.

A major underground forum, RAMP, which also functioned as a platform through which threat actors advertised their ransomware services and published service‑related updates, got seized by authorities in January 2026.

Another underground forum, LeakBase, where malicious actors distributed exfiltrated and compromised data, was seized in March 2026. However, while law enforcement agencies are actively shutting down dark web platforms and ransomware data leak sites, similar portals may appear over time.

Active groups

Among the most active ransomware groups in 2025 based on data leak sites, Kaspersky identified Qilin as the dominant ransomware-as-a-service (RaaS) operator following RansomHub’s seizure of operations. Clop ranked as the second most active group, with Akira in the third place.

While several major ransomware groups stopped operation in 2025, new actors emerge. Looking at 2026, the Gentlemen is one of the most important new ransomware actors due to the group’s rapid growth, structured operations, and increasing focus on data-centric extortion. The group may include attackers formerly associated with other major ransomware operations.

The Gentlemen exemplify a broader shift in the ransomware ecosystem away from chaotic, high-noise campaigns toward scalable, business-like extortion models focused primarily on stealing sensitive data and leveraging reputational and regulatory pressure rather than relying solely on disruptive file encryption.

“Ransomware has evolved into a highly organised ecosystem focused on monetising stolen data, disabling defences, and scaling attacks with business-like efficiency. Threat actors are quickly adapting, weaponising legitimate tools, exploiting remote access infrastructure, and even adopting post-quantum cryptography years earlier than many expected.

“The purpose of Anti-Ransomware Day is to raise global awareness about the threats posed by ransomware and to promote best practices for prevention and response, and we urge all users to stay secure, set up layered defences, invest in backups and boost cyberliteracy levels to counter attacks,” comments Fabio Assolini, Lead Security Researcher at Kaspersky GReAT.

On Anti-Ransomware Day and beyond, Kaspersky encourages organisations to follow these best practices to safeguard from ransomware:

• Enable ransomware protection for all endpoints. There is a free Kaspersky Anti-Ransomware Tool for Business that shields computers and servers from ransomware and other types of malware, prevents exploits and is compatible with already installed security solutions.
• Always keep software updated on all the devices you use to prevent attackers from exploiting vulnerabilities and infiltrating your network.
• Focus your defence strategy on detecting lateral movements and data exfiltration to the Internet. Pay special attention to outgoing traffic to detect cybercriminals’ connections to your network. Set up offline backups that intruders cannot tamper with. Make sure you can access them quickly when needed or in an emergency.
• Companies from non-industrial sector can protect themselves by installing anti-APT and EDR solutions that enable capabilities for advanced threat discovery and detection, investigation and timely remediation of incidents. Organizations can also provide their SOC teams with access to the latest threat intelligence and regularly upskill them with professional training.

Kaspersky has detected phishing and business email compromise (BEC) attacks that are leveraging Amazon Simple Email Service (SES) – a cloud-based email service designed for businesses and developers to send and receive high-volume marketing, notification, and transactional emails (for instance, password resets).

Because these emails are sent via a trusted service, they originate from reputable IP addresses, frequently include legitimate “.amazonses.com” identifiers. This makes phishing messages nearly indistinguishable from legitimate correspondence at a technical level. Users should treat unexpected emails with extreme caution.

The attacks are driven by the theft and exposure of credentials from Amazon Web Services (AWS). The attackers are using leaked AWS Identity and Access Management Keys – often found in public repositories, misconfigured cloud storage, and exposed configuration files. With automated tools, threat actors can identify valid keys and abuse them to send large volumes of malicious emails through legitimate infrastructure operated by Amazon.

Attackers disguise malicious links behind trusted domains such as amazonaws.com using redirects and by creating highly convincing HTML email templates. In many cases, phishing pages are hosted on infrastructure that appears legitimate, further increasing the likelihood of credential theft from victims.

One of the campaigns observed by Kaspersky in early 2026 involved emails impersonating document-signing platforms like DocuSign. Victims were prompted to review and sign documents, only to be redirected to fraudulent login pages hosted on an Amazon Web Services page designed to capture credentials.

Researchers also identified business email compromise attacks carried out via Amazon SES in which attackers impersonated employees and fabricated entire email threads with suppliers. These messages, often sent to finance departments, requested urgent payments and included PDF attachments containing only banking details – with no malicious links – making detection challenging.

“We’ve seen attackers abuse trusted platforms before – like in cases with Google Tasks and Google Forms – where scammers rely on built-in notification mechanisms to deliver phishing links from legitimate domains like @google.com, effectively bypassing email filters and exploiting user trust.

“However, the abuse of Amazon SES represents a more advanced stage of this trend: instead of merely leveraging a platform’s notification features, attackers compromise cloud credentials and gain direct control over a trusted email-sending infrastructure. This allows them to scale attacks, fully customise messages, and deliver phishing emails that are hard to distinguish from legitimate business communications,” commented Roman Dedenok, Anti-Spam Expert at Kaspersky.

National Information Technology Development Agency (NITDA) has reaffirmed that a strong and reliable digital infrastructure is fundamental to attracting investment, boosting competitiveness, and achieving sustainable growth within Nigeria’s startup ecosystem.

NITDA

This position was underscored at the Africa Fintech Foundry Ecosystem Roundtable 7.0, a virtual engagement themed “The Capital Reset: What Technologies Are Still Fundable in Africa?”

Speaking on behalf of Kashifu Inuwa, Director General of NITDA, the Special Assistant on Digital Transformation to the DG, Muhammad Aminu, emphasised that investors are increasingly drawn to startups operating in environments supported by dependable digital infrastructure and clear, predictable policy frameworks.

He explained that digital infrastructure goes far beyond basic internet access. According to him, it encompasses cloud computing systems, digital identity frameworks, payment infrastructure, data exchange platforms, interoperability standards, cybersecurity architecture, and emerging artificial intelligence technologies.

He noted that, “These foundational systems significantly lower operational barriers for startups, enabling founders to focus on innovation, customer acquisition, and scaling, rather than having to build essential infrastructure independently.”

From an investment standpoint, Aminu observed that robust digital infrastructure reduces uncertainty, lowers operational risk, enhances scalability, and considerably cuts the cost of expansion, thereby making startups more attractive to both local and international investors.

He further highlighted several ongoing government initiatives aimed at strengthening Nigeria’s digital ecosystem. These include sovereign cloud projects, data interoperability frameworks, cloud adoption policies, cybersecurity and data governance reforms, as well as the implementation of the Nigeria Startup Act.

In addition, he stressed that regulatory clarity and consistency in policy direction remain critical in attracting sustained investment into the technology sector.

Aminu also noted that NITDA is giving priority to human capital development through the 3 Million Technical Talent (3MTT) programme, describing skilled manpower as a vital component of digital infrastructure.

In conclusion, he stated that a strong, well‑structured digital infrastructure framework not only lowers the cost of innovation but also boosts investor confidence and supports the long‑term growth and expansion of Nigeria’s startup ecosystem.