Ransomware attacks in April 2025
593 victims · 60 active groups · 6 new groups · 736 in March 2025 · Updated Oct 14, 2026
Key findings
- HackerFeeds recorded 593 ransomware victims claimed on leak sites in April 2025, down 19.4% from 736 in March 2025.
- 60 groups posted at least one victim; the three most active groups, akira (74), safepay (54) and qilin (46), accounted for 29.3% of the total.
- akira was the most active group with 74 victims, up from 65 in March 2025.
- Manufacturing was the most-targeted sector with 88 victims (14.8% of the month's total), ahead of Business Services (73).
- Organizations in the United States accounted for 255 victims (43.0%), followed by Germany (46) and Canada (25); 15 victims did not disclose a location.
- 6 groups appeared in HackerFeeds data for the first time this month, including warlock, brotherhood and bert.
Daily activity
Busiest day: Apr 4 (37 victims). Quietest day: Apr 19 (8 victims). Victims were posted on 30 of 30 days.
Most active groups
| # | Group | Victims | Share | March 2025 | Change |
|---|---|---|---|---|---|
| 1 | akira | 74 | 12.5% | 65 | +9 |
| 2 | safepay | 54 | 9.1% | 42 | +12 |
| 3 | qilin | 46 | 7.8% | 44 | +2 |
| 4 | play | 36 | 6.1% | 34 | +2 |
| 5 | nightspire | 22 | 3.7% | 19 | +3 |
| 6 | lynx | 22 | 3.7% | 27 | −5 |
| 7 | dragonforce | 21 | 3.5% | 18 | +3 |
| 8 | killsec | 20 | 3.4% | 17 | +3 |
| 9 | incransom | 20 | 3.4% | 23 | −3 |
| 10 | babuk2 | 18 | 3.0% | 87 | −69 |
| 11 | hunters | 16 | 2.7% | 6 | +10 |
| 12 | sarcoma | 14 | 2.4% | 10 | +4 |
| 13 | medusa | 14 | 2.4% | 17 | −3 |
| 14 | devman | 13 | 2.2% | 1 | +12 |
| 15 | SilentRansomGroup | 12 | 2.0% | 20 | −8 |
Targeted sectors
| # | Sector | Victims | Share of month |
|---|---|---|---|
| 1 | Manufacturing | 88 | 14.8% |
| 2 | Business Services | 73 | 12.3% |
| 3 | Technology | 65 | 11.0% |
| 4 | Financial Services | 43 | 7.3% |
| 5 | Consumer Services | 41 | 6.9% |
| 6 | Construction | 41 | 6.9% |
| 7 | Healthcare | 35 | 5.9% |
| 8 | Transportation/Logistics | 29 | 4.9% |
| 9 | Public Sector | 29 | 4.9% |
| 10 | Education | 20 | 3.4% |
| 11 | Agriculture and Food Production | 19 | 3.2% |
| 12 | Hospitality and Tourism | 18 | 3.0% |
Countries
| # | Country | Victims | Share of month |
|---|---|---|---|
| 1 | United States | 255 | 43.0% |
| 2 | Germany | 46 | 7.8% |
| 3 | Canada | 25 | 4.2% |
| 4 | Italy | 20 | 3.4% |
| 5 | United Kingdom | 20 | 3.4% |
| 6 | Spain | 14 | 2.4% |
| 7 | Singapore | 13 | 2.2% |
| 8 | India | 9 | 1.5% |
| 9 | France | 9 | 1.5% |
| 10 | Brazil | 9 | 1.5% |
| 11 | Australia | 9 | 1.5% |
| 12 | Taiwan | 8 | 1.3% |
| 13 | Japan | 8 | 1.3% |
| 14 | Switzerland | 8 | 1.3% |
| 15 | Portugal | 7 | 1.2% |
15 victims (2.5%) did not disclose a location.
Groups seen for the first time
| Group | First victim |
|---|---|
| warlock | Apr 2, 2025 |
| brotherhood | Apr 4, 2025 |
| bert | Apr 4, 2025 |
| gunra | Apr 7, 2025 |
| direwolf | Apr 17, 2025 |
| payoutsking | Apr 17, 2025 |
“First time” means the group’s earliest victim in our dataset falls in this month; a group may have operated earlier under another name.
Latest victims of the month
| Victim | Group | Country | Date |
|---|---|---|---|
| SIMCO Electronics | bert | US | Apr 30, 2025 |
| Telco Intercontinental | hunters | US | Apr 30, 2025 |
| FCC | hunters | ES | Apr 30, 2025 |
| Digestive Specialists | hunters | US | Apr 30, 2025 |
| Wizz Air | stormous | HU | Apr 30, 2025 |
| www.cmic-cmo.com | qilin | JP | Apr 30, 2025 |
| Matrix New World Engineering | qilin | US | Apr 30, 2025 |
| mossyoak.com | qilin | US | Apr 30, 2025 |
| dlcid.com | qilin | US | Apr 30, 2025 |
| nuovadfl.it | qilin | IT | Apr 30, 2025 |
| Southwood Financial,SWF FUNDING LLC, EduCap Inc. | akira | US | Apr 30, 2025 |
| GARDNER ORTHOPEDICS | incransom | US | Apr 30, 2025 |
Methodology
Counts are victims publicly claimed on ransomware leak sites, as aggregated from ransomware.live, and are dated by the claim’s publication date (UTC). Claims are made by the criminal groups themselves and are not independently verified; a listing does not confirm that an attack took place or that data was stolen. Shares are calculated against the month’s total of 593 victims, and sector and country fields reflect what was disclosed in each listing. See our methodology for details.