SpiderLabs Ransomware Tracker Update October 2025: Qlin Doubles Down on Attacks
The worldwide ransomware landscape saw a dramatic shift in attacks in October 2025, jumping 41% month over month, with the most prolific attacker, Qlin, more than doubling the number of attacks it launched, according to Trustwave, A LevelBlue Company, research.
The US remained the primary recipient of ransomware attacks, but October saw manufacturing overtake technology as the most targeted vertical sector.
The ransomware information was derived from a new Trustwave SpiderLabs ransomware-tracking tool that gathers information from a variety of open intelligence sources and our own proprietary research.
This unique combination of open-source and in-house research provides new insights into ransomware attack trends, the threat groups involved, and their primary targets. The data is not all-inclusive but contains enough information to draw basic conclusions on the direction attacks are taking.
October Attack Figures
In October 2025, SpiderLabs recorded 722 ransomware attacks worldwide, up from 492 in September 2025 and 635 in October 2024.
As noted, the US was the nation most under attack with 298 incidents noted, followed by Canada and France with 45 and 25 attacks, respectively.
Top 5 Threat Groups
Qlin again dominated the stage, but there were some changes in the top five list. Sinobi appeared in third place, pushing Incransom down to fourth and Play to fifth.
A quick breakdown of the new threat actor on the list:
- According to Ransomware.live, Sinobi became active in July 2025 and has so far specialized in attacking healthcare, manufacturing, and construction firms.
Top Threat Groups for October 2025
Table 1.
Top Vertical Sectors Targeted for October 2025
Table 2.
SpiderLabs’ research noted a major shift in targeting when data is examined year over year. In October of 2024, business services were the most often targeted vertical sector, followed by manufacturing and technology.
2025 Ransomware Attacks to Date
Table 3.
Total attacks tracked to date for 2025 are 6,251, up dramatically from the 4,660 SpiderLabs saw in 2024. One data point from the target sector list to call out for October is manufacturing supplanted technology as the threat actor’s favorite victim sector.
Defending Against Ransomware
Trustwave, A LevelBlue Company, offers a number of services and solutions to help organizations defend themselves against ransomware and recover if successfully attacked.
Trustwave’s Ransomware Preparedness service, unlike many offerings in the market today, doesn’t focus on singular aspects of a client’s security defense but looks at all critical lines of defense, using detailed insights and aggregated information to provide client security and business leaders.
The service provides detailed assessments of the organization’s overall preparedness, an understanding of its existing capabilities to identify, respond to, and recover from a ransomware incident, and identification of the gaps, opportunities, and inherent risks it faces.
In addition, Trustwave can help with the basic mitigations all organizations should implement including:
- Enhance cybersecurity hygiene and patch management
- Implement robust backup and recovery plans
- Employee training and awareness
- Multi-Factor Authentication (MFA) and strong credential management
- Incident response planning