Cyber Attack Landscape Shifts: Ransomware Surges 46% Amidst GenAI Threats to Critical Sectors
Global Cyber Threats: A Shifting Landscape of Declining Volumes and Surging Ransomware
The global cyber threat landscape in September 2025 presented a paradoxical scenario: while overall attack volumes experienced a slight moderation, the insidious threat of ransomware saw a dramatic escalation, surging by 46% compared to the same period in 2024. This period also highlighted the burgeoning risks associated with Generative AI (GenAI), which is increasingly being weaponized to target critical sectors such as education, telecommunications, and government. These converging trends signal a more complex and challenging environment for cybersecurity professionals worldwide.
Ransomware Resurgence and Regional Hotspots
September 2025 witnessed a sharp resurgence in ransomware activity, with a total of 562 publicly reported attacks. This represents a substantial 46% increase year-over-year, underscoring the persistent and evolving nature of this disruptive threat. North America remained the most heavily impacted region, accounting for 54% of all reported ransomware incidents. Europe followed, representing 19% of cases. Within North America, the United States bore the brunt, with 52% of all ransomware cases originating from the country, followed by Korea (5%), the United Kingdom (4%), and Germany (4%).
Regionally, Africa continued to experience the highest average number of cyber attacks per organization, although volumes saw a 10% decrease year-over-year to 2,902 weekly attacks. Latin America followed closely with 2,826 weekly attacks, marking a 7% increase year-over-year. The Asia-Pacific region registered 2,668 attacks, a 10% decline compared to the previous year. Europe saw an average of 1,577 weekly attacks, down 1% year-over-year. In stark contrast, North America recorded 1,468 attacks per week, representing the largest increase among all regions at 17%. This regional polarization indicates that while some areas might be experiencing temporary relief, others, particularly North America, are grappling with a significant uptick in sophisticated ransomware and data extortion campaigns.
The Growing Shadow of Generative AI
The rapid integration of generative AI tools into enterprise workflows has introduced a new frontier of cybersecurity risks, particularly concerning data leakage. In September, a significant 1 in every 54 GenAI prompts originating from enterprise networks posed a high risk of sensitive data exposure. This threat impacted a staggering 91% of organizations that regularly utilize GenAI tools. Furthermore, approximately 15% of all prompts contained potentially sensitive information, including customer data, internal communications, or proprietary code snippets. These findings underscore a critical imperative: the urgent need for robust governance and security controls surrounding the adoption of GenAI. Without adequate safeguards, the pursuit of productivity gains through AI could inadvertently lead to substantial data security risks and breaches.
Industry Vulnerabilities: Education, Telecom, and Government Under Fire
The education sector continued its unenviable position as the most targeted industry, averaging 4,175 weekly attacks per organization. Despite a 3% year-over-year decrease, this volume remains significantly higher than any other sector. The telecommunications industry ranked second, with 2,703 weekly attacks—a 6% rise year-over-year. Government institutions followed closely, experiencing 2,512 weekly attacks, a 6% decline year-over-year. These trends consistently reaffirm that data-rich and service-critical sectors remain prime targets for cybercriminals. Attackers exploit their deep dependency on digital infrastructure and sensitive data flows, particularly in environments characterized by hybrid work models, cloud integration, and the coexistence of legacy systems.
Ransomware Dynamics: Top Groups and Evolving Tactics
Insights gleaned from threat actor data leak sites reveal a dynamic ransomware ecosystem. The leading ransomware groups in September included:
- Qilin (14.1%): A prominent Ransomware-as-a-Service (RaaS) group that has maintained consistent victim disclosures since 2022. Following the retirement of RansomHub, Qilin has reportedly expanded its affiliate network, utilizing a Rust-based encryptor and an advanced RaaS panel.
- Play (9.3%): Also known as PlayCrypt, this group targets organizations across North America, South America, and Europe. They are known for exploiting unpatched vulnerabilities, particularly in Fortinet SSL VPNs, and employing living-off-the-land binaries (LOLBins) for stealthy operations.
- Akira (7.3%): Active since early 2023, Akira
AI Summary
In September 2025, the global cyber threat landscape presented a complex picture: while overall attack volumes saw a slight decrease, ransomware incidents experienced a significant surge of 46% compared to the previous year. This period also marked the growing impact of Generative AI (GenAI) on cybersecurity, introducing new vectors for data exposure and sophisticated attack methods. The education sector remained the most frequently targeted, followed by telecommunications and government institutions, highlighting their continued appeal due to data richness and critical service provision. Regionally, North America recorded the most substantial increase in attacks, up 17% year-over-year, indicating a growing concentration of sophisticated threats in the region. Africa and Latin America also experienced high attack volumes, though with varying year-over-year trends. The proliferation of GenAI tools in enterprise workflows introduced significant data risks, with a notable percentage of GenAI prompts posing a high risk of sensitive data exposure, affecting a large majority of organizations utilizing these tools. This underscores the urgent need for robust governance and security controls around GenAI adoption to mitigate potential data security compromises. Ransomware activity saw a sharp resurgence, with North America and Europe being the most affected regions. The U.S. alone accounted for a significant portion of these incidents. Key ransomware groups like Qilin, Play, and Akira demonstrated the professionalization of the ransomware-as-a-service (RaaS) model, leveraging advanced techniques and rapid tool development. The report emphasizes that despite stable overall numbers, attackers are intensifying their operations, refining techniques, and exploiting vulnerabilities. This necessitates a multi-layered, prevention-first security approach, moving beyond traditional detection methods to proactive, real-time protection across all digital environments. The insights are derived from Check Point