In 2025, #ESETresearch analyzed hundreds of hands-on-keyboard ransomware attacks, mostly hitting manufacturing, construction, retail, technology, and healthcare. Most of these were seen in the US (17%), Spain (5%), and France, Italy, and Canada (4% each). Publicly reported victim numbers grew by almost 40% YoY (acc to ecrime.ch), and we expect to see that growth continue in 2026. #Qilin and #Akira gangs were, and probably will remain, the leading RaaS, but we think #Warlock gang is the one to watch closely. Warlock, a newcomer operating as a closed group, stands out for its technical skill, with quick adoption of new intrusion techniques and novel attack chains, such as the abuse of vulnerable #Velociraptor chained with VS Code to establish a stealthy remote connection. Headline-producing vectors such as SIM swaps, vishing, and 0-days will grab media attention in 2026, but most incidents will still start by exploiting weak passwords, unpatched systems, open RDP ports, and edge device vulnerabilities. EDR killers will keep surfacing. For additional predictions, the most expensive ransomware attack of 2025, or the good news corner, read the whole ransomware section in #ESETThreatReport https://web-assets.esetstatic.com/wls/en/papers/threat-reports/eset-threat-report-h22025.pdf