Coveware by Veeam reveals Q2 2025 ransomware surge

Coveware by Veeam veiled its Q2 2025 ransomware report, spotlighting a dramatic escalation in targeted social engineering attacks and a surge in ransom payments driven by sophisticated data exfiltration tactics.

“The second quarter of 2025 marks a turning point in ransomware, as targeted social engineering and data exfiltration have become the dominant playbook,” said Bill Siegel, CEO of Coveware by Veeam. “Attackers aren’t just after your backups – they’re after your people, your processes, and your data’s reputation. Organisations must prioritise employee awareness, harden identity controls, and treat data exfiltration as an urgent risk, not an afterthought,”

Key Q2 2025 findings from Coveware by Veeam include:

• Social engineering drives the biggest threats: Three major ransomware groups – Scattered Spider, Silent Ransom, and Shiny Hunters – dominated the quarter, each leveraging highly targeted social engineering to breach organisations across sectors. These groups abandoned mass opportunistic attacks for precision strikes, using novel impersonation tactics against help desks, employees, and third-party service providers.
• Ransom payments soar to new highs: Both the average and median ransom payments rocketed to $1.13 million (+104% from Q1 2025) and $400,000 (+100% from Q1 2025), respectively. This spike is attributed to larger organisations paying out after data exfiltration-only incidents, even as the overall rate of organisations paying ransoms held steady at 26%.
• Data theft overtakes encryption as primary extortion method: Exfiltration was a factor in 74% of all cases, with many campaigns now prioritising data theft over traditional system encryption. Multi-extortion tactics and delayed threats are on the rise, keeping organisations in the crosshairs long after an initial breach.
• Professional services, healthcare, and consumer services hit hardest: Professional services (19.7%), healthcare (13.7%), and consumer services (13.7%) bore the brunt of attacks. Mid-sized companies (11 – 1,000 employees) comprised 64% of victims, a sweet spot for attackers balancing payout potential against less mature defences.
• Attack techniques evolve, human factor remains key vulnerability: Credential compromise, phishing, and exploitation of remote services continue to dominate initial access, with attackers increasingly bypassing technical controls via social engineering. Groups regularly exploit vulnerabilities in widely-used platforms (Ivanti, Fortinet, VMware), and “lone wolf” attacks by seasoned extortionists using generic, unbranded toolkits are on the rise.
• New entrants reshape ransomware rankings: Q2’s top ransomware variants were Akira (19%), Qilin (13%), and Lone Wolf (9%), while Silent Ransom and Shiny Hunters entered the top five for the first time.

Coveware by Veeam has helped thousands of cyber extortion victims and developed industry leading software and services that enable rapid forensic triage, extortion negotiation and remediation, cryptocurrency settlements and decryption services with a singular goal and outcome – data recovery from ransomware attacks. Through these incidents, Coveware by Veeam has gathered data and insights on threat actor patterns that provide an unrivaled view of the current threat landscape. These valuable findings are shared with customers to help educate and reduce risks, improve security posture, and ensure rapid recovery. Select Coveware by Veeam capabilities are incorporated into Veeam offerings including Veeam Data Platform and the Veeam Cyber Secure Programme, delivering the insights and capabilities to a broader set of customers. 

Coveware by Veeam’s quarterly report is based on firsthand data, expert insights and analysis from the ransomware and cyber extortion cases that they manage each quarter. Utilising real-time incident response, proprietary forensic tools (including Recon Scanner), and comprehensive documentation of threat actor behaviour, attack vectors, and negotiation outcomes. By aggregating and analysing case-specific data – rather than relying on third-party sources – Coveware by Veeam is able to identify emerging trends, track tactics, techniques, and procedures (TTPs), and provide actionable, experience-based intelligence on the rapidly evolving ransomware landscape.