The global ransomware economy is collapsing under growing resistance from its targets. According to new data from cybersecurity firm Coveware, the third quarter of 2025 saw ransomware payments drop to a historic low, with just 23% of victims paying attackers—a continuation of a six-year downward trend. Even when ransoms were paid, the average payment plunged by 66%, marking one of the most dramatic contractions in cyber extortion profitability to date.
This shift is not coincidental. Companies have learned that paying the ransom rarely prevents data leaks, and law enforcement guidance increasingly supports a strict no-payment stance. Privacy attorneys are also advising organizations to refuse payment, particularly in cases of data exfiltration-only attacks, where victims gain little to nothing by complying. As a result, the ransomware “business model” is faltering, with fewer payouts starving the criminal ecosystem that depends on steady Bitcoin inflows.
Facing these headwinds, threat groups like Akira and Qilin have pivoted to a high-volume, low-demand strategy. Rather than chasing multi-million-dollar payouts from major enterprises, these gangs are now flooding mid-sized companies with smaller ransom demands—an approach that exploits limited budgets and weaker security postures. The data shows that the median victim size rose to 362 employees, suggesting that attackers are deliberately targeting organizations large enough to pay something, but small enough to lack enterprise-level defenses.
Despite these strategic shifts, attackers continue to rely on basic entry points rather than sophisticated exploits. Over half of all ransomware incidents still begin with compromised remote access services, weak passwords, and misconfigured systems. Meanwhile, phishing campaigns and unpatched software vulnerabilities—most of them years old—remain the easiest paths for compromise. This underscores that ransomware operations thrive on poor hygiene, not innovation.
Experts view this decline in ransom payments as an encouraging milestone. With fewer victims paying, the economics of ransomware are becoming unsustainable, forcing groups to fragment or lower their demands to stay operational. The Coveware report concludes that this trend represents meaningful progress: the more organizations refuse to pay, the less incentive attackers have to continue. However, the industry must remain vigilant—especially mid-sized companies, which now face a rising tide of smaller but more frequent attacks.
As the ransomware economy contracts, the message is clear: resilience and refusal work. By focusing on foundational defenses—multi-factor authentication, strict patching, and secure remote access—organizations can help starve the cyber extortion ecosystem and push ransomware further toward collapse.
#Ransomware #Coveware #CyberExtortion #AkiraRansomware #QilinRansomware #Cybersecurity #ThreatIntelligence #RansomwarePayments #Phishing #RemoteAccessSecurity #VulnerabilityManagement #InfoSec #DataBreach #CyberCrime #NoRansomPolicy #CyberDefense #IncidentResponse #Q32025 #CyberThreatReport
