In this episode of The Dark Dive we check in on the ransomware landscape, following major developments identified by the Searchlight Cyber threat intelligence team.

Luke Donovan, Head of Threat Intelligence at Searchlight Cyber, shares trends that his team has identified from the dark web in 2025 including: an escalation in the number of ransomware attacks, more than 35 new ransomware groups emerging, and alarming new tactics for vulnerability exploitation and victim extortion.

This episode also features the famous Searchlight "Top Five Ranking" of ransomware groups, discussion of why LockBit has disappeared from the list, and advice for private sector and government cybersecurity professionals in a hostile ransomware landscape.

Further reading:

- The report discussed throughout the episode, "An Escalation in Attacks: The Ransomware Landscape in H1 2025": https://www.slcyber.io/whitepapers-reports/an-escalation-in-attacks-the-ransomware-landscape-in-h1-2025/

- Our dedicated podcast on the recent hack of LockBit, "A Deep Dive Into The LockBit Data Leaks" (mentioned at 30.00): https://slcyber.io/podcasts/a-deep-dive-into-the-lockbit-data-leaks/

- Our previous ransomware report where we predicted Akira as a group to watch, "More Groups, More Problems: Ransomware in 2023" (mentioned at 32.49): https://slcyber.io/whitepapers-reports/ransomware-in-2023/

- Our previous podcast episode on Qilin's attack on the UK's National Health Service, "The Qilin Ransomware Group vs The National Health Service" (mentioned 34.35): https://slcyber.io/podcasts/the-qilin-ransomware-group-vs-the-national-health-service/

- The ransomware report we released at the beginning of this year, where RansomHub featured no.1, "Same Game, New Players: Ransomware in 2025" (mentioned 36.35): https://slcyber.io/whitepapers-reports/same-game-new-players-ransomware-in-2025/

Want to find out more or have a suggestion for future podcast episodes?

Email: thedarkdive@slcyber.io

Website: www.slcyber.io

LinkedIn: www.linkedin.com/company/searchlight-cyber

X: www.twitter.com/SLCyberSec

Weekly newsletter: www.slcyber.io/beacon/