Global Cyber Threats: A Shifting Landscape of Declining Volumes and Surging Ransomware

The global cyber threat landscape in September 2025 presented a paradoxical scenario: while overall attack volumes experienced a slight moderation, the insidious threat of ransomware saw a dramatic escalation, surging by 46% compared to the same period in 2024. This period also highlighted the burgeoning risks associated with Generative AI (GenAI), which is increasingly being weaponized to target critical sectors such as education, telecommunications, and government. These converging trends signal a more complex and challenging environment for cybersecurity professionals worldwide.

Ransomware Resurgence and Regional Hotspots

September 2025 witnessed a sharp resurgence in ransomware activity, with a total of 562 publicly reported attacks. This represents a substantial 46% increase year-over-year, underscoring the persistent and evolving nature of this disruptive threat. North America remained the most heavily impacted region, accounting for 54% of all reported ransomware incidents. Europe followed, representing 19% of cases. Within North America, the United States bore the brunt, with 52% of all ransomware cases originating from the country, followed by Korea (5%), the United Kingdom (4%), and Germany (4%).

Regionally, Africa continued to experience the highest average number of cyber attacks per organization, although volumes saw a 10% decrease year-over-year to 2,902 weekly attacks. Latin America followed closely with 2,826 weekly attacks, marking a 7% increase year-over-year. The Asia-Pacific region registered 2,668 attacks, a 10% decline compared to the previous year. Europe saw an average of 1,577 weekly attacks, down 1% year-over-year. In stark contrast, North America recorded 1,468 attacks per week, representing the largest increase among all regions at 17%. This regional polarization indicates that while some areas might be experiencing temporary relief, others, particularly North America, are grappling with a significant uptick in sophisticated ransomware and data extortion campaigns.

The Growing Shadow of Generative AI

The rapid integration of generative AI tools into enterprise workflows has introduced a new frontier of cybersecurity risks, particularly concerning data leakage. In September, a significant 1 in every 54 GenAI prompts originating from enterprise networks posed a high risk of sensitive data exposure. This threat impacted a staggering 91% of organizations that regularly utilize GenAI tools. Furthermore, approximately 15% of all prompts contained potentially sensitive information, including customer data, internal communications, or proprietary code snippets. These findings underscore a critical imperative: the urgent need for robust governance and security controls surrounding the adoption of GenAI. Without adequate safeguards, the pursuit of productivity gains through AI could inadvertently lead to substantial data security risks and breaches.

Industry Vulnerabilities: Education, Telecom, and Government Under Fire

The education sector continued its unenviable position as the most targeted industry, averaging 4,175 weekly attacks per organization. Despite a 3% year-over-year decrease, this volume remains significantly higher than any other sector. The telecommunications industry ranked second, with 2,703 weekly attacks—a 6% rise year-over-year. Government institutions followed closely, experiencing 2,512 weekly attacks, a 6% decline year-over-year. These trends consistently reaffirm that data-rich and service-critical sectors remain prime targets for cybercriminals. Attackers exploit their deep dependency on digital infrastructure and sensitive data flows, particularly in environments characterized by hybrid work models, cloud integration, and the coexistence of legacy systems.

Ransomware Dynamics: Top Groups and Evolving Tactics

Insights gleaned from threat actor data leak sites reveal a dynamic ransomware ecosystem. The leading ransomware groups in September included:

Qilin (14.1%): A prominent Ransomware-as-a-Service (RaaS) group that has maintained consistent victim disclosures since 2022. Following the retirement of RansomHub, Qilin has reportedly expanded its affiliate network, utilizing a Rust-based encryptor and an advanced RaaS panel.
Play (9.3%): Also known as PlayCrypt, this group targets organizations across North America, South America, and Europe. They are known for exploiting unpatched vulnerabilities, particularly in Fortinet SSL VPNs, and employing living-off-the-land binaries (LOLBins) for stealthy operations.
Akira (7.3%): Active since early 2023, Akira

Tag: data security

Cyber Attack Landscape Shifts: Ransomware Surges 46% Amidst GenAI Threats to Critical Sectors