Cybercriminals continue to profit handsomely, with nearly half of all victimised organisations paying ransom demands in 2025.

This is despite global efforts to curb the spread of ransomware, according to the State of Ransomware 2025 report released by Sophos, a global leader in cybersecurity solutions.

The sixth annual edition of the report, which surveyed 3,400 IT and cybersecurity leaders across 17 countries, revealed that 49 per cent of organisations hit by ransomware attacks opted to pay the ransom to regain access to their encrypted data, the second-highest payment rate recorded by Sophos in the last six years.

While the median ransom demand decreased by a third compared to 2024, the median payment still stood at $1 million, underscoring the continued profitability of ransomware for cybercriminals. Notably, 53 per cent of organisations that paid a ransom were able to negotiate a lower settlement than initially demanded, often through third-party negotiators or internal efforts.

In his reaction, Chester Wisniewski, director and field CISO at Sophos,  averred that for many organisations, the chance of being compromised by ransomware actors is just a part of doing business in 2025, adding that the good news is that, thanks to this increased awareness, many companies are arming themselves with resources to limit damage.

Among those who paid less than the initial demand, 71 per cent successfully negotiated a lower figure. While this signals an increasing awareness and tactical response among victim organisations, the report also noted persistent challenges.

For the third consecutive year, exploited vulnerabilities were identified as the leading technical root cause of ransomware attacks.

Alarmingly, 40 percent of victims said attackers exploited a security gap they were unaware of, underscoring a widespread lack of visibility into organizations’ digital infrastructure.

Additionally, 63 per cent of respondents cited resource constraints, including insufficient personnel or expertise, as contributing factors to their susceptibility. For large enterprises (3,000+ employees), lack of expertise topped the list, while mid-sized organisations (251–500 employees) most frequently cited a lack of personnel.

The use of data backups to restore information following an attack has fallen to its lowest point in six years, with only 54 per cent of companies relying on backups — a drop from previous years.

Despite this, organisations are recovering faster: 53 per cent reported full recovery within one week, up from 35 per cent in 2024. Only 18 percent of firms took over a month to recover, a significant improvement from last year’s 34 per cent.

Sophos attributes these gains to better incident response capabilities and a growing trend toward using Managed Detection and Response (MDR) services.

Such services help companies detect attacks early, respond effectively, and, in some cases, stop attacks in progress.

The report also found significant variation in ransom demands based on industry and company size, adding that organisations with over $1 billion in revenue faced median ransom demands of $5 million; those earning $250 million or less saw demands under $350,000; state and local governments reported the highest median ransom payments at $2.5 million and healthcare organisations paid the lowest, at a median of $150,000.

While attackers are still extracting sizable payments, the overall cost of ransomware recovery has dropped, from $2.73 million in 2024 to $1.53 million in 2025. Sophos credits increased preparedness, improved threat visibility, and wider use of professional response services for this decline.

To further reduce the risk and impact of ransomware, Sophos advises organisations to regularly patch known vulnerabilities and maintain updated security systems; employ multi-factor authentication (MFA) and anti-ransomware protection across all endpoints; use MDR services or maintain 24/7 internal security monitoring; test and maintain a robust incident response plan and ensure regular backups are not only taken but tested for restoration.

As ransomware evolves, so must corporate defenses.

Though the profitability of ransomware remains alarmingly high, the increasing resilience among targeted organisations is a sign of hope and a call to action for those still behind the curve.

Nigeria Computer Society (NCS) recently advocated digital literacy to enhance cyber security in the country.

Muhammad Aliyu, president, NCS, said this in an interview with reporter on the sidelines of the Cybersecurity Forum and Workshop organised by the society in Abuja.

The event had as its theme: `Digital Sovereignty: Building an Agile and Resilient Nation.’

According to him, cyber-attacks were growing in scale, sophistication and impact.

Aliyu said the cyber security landscape in 2024 was shaped by increasing reliance on digital space.

He said that to tackle these challenges, countries and organisations should adopt proactive strategies that leverage local innovations, address skills gaps, and ensure regulatory compliance.

He said collaboration among governments, the private sector and experts was vital for creating a resilient digital ecosystem.

‘’The future of cyber security relies on continuous innovation, education, and collaboration to protect our interconnected world,’’ he said.

He told the reporter that the forum was meant to bring together policymakers, cyber security experts, academics, industry leaders, and practitioners to harness strategies and share insights on achieving cyber security sovereignty.

“The focus is on assessing a nation’s capability to govern, regulate, protect and secure its digital infrastructure, data, technological assets, and cyber-environment.

“These are vital for preserving national security and digital economy, personal data privacy safeguards, and technological dependency,’’Aliyu said.

He emphasised the importance of dialogue and shared expertise in strengthening collective cyber security and ensuring a safer digital future.

Aliyu encouraged participants to take advantage of the forum’s networking opportunities, leveraging their diversity to learn from one another and broaden their knowledge on defending against cyber threats.

‘’The Nigerian Computer Society is committed to creating platforms for IT professionals to share knowledge and stay up-to-date with challenges in the sector,’’ he said.

NCS is umbrella and the premier body of all Computing and Information Technology (IT) professionals, interest groups, and stakeholders in Nigeria.

It’s core mission is to advance the science and practice of computing and information technology in the country.

In 2025, nearly 8,500 users from small and medium-sized businesses (SMBs) globally faced cyberattacks where malicious or unwanted software was disguised as popular online productivity tools, Kaspersky reports.

Based on the unique malicious and unwanted files observed, the most common lures included Zoom and Microsoft Office, with newer AI-based services like ChatGPT and DeepSeek being increasingly exploited by attackers. Kaspersky has released threat analysis and mitigation strategies to help SMBs respond.

Kaspersky analysts explored how frequently malicious and unwanted software are disguised as legitimate applications commonly used by SMBs, using a sample of 12 online productivity apps. In total, Kaspersky observed more than 4,000 unique malicious and unwanted files disguised as popular apps in 2025. With the growing popularity of AI services, cybercriminals are increasingly disguising malware as AI tools.

The number of cyberthreats mimicking ChatGPT increased by 115% in the first four months of 2025 compared to the same period last year, reaching 177 unique malicious and unwanted files. Another popular AI tool, DeepSeek, accounted for 83 files. This large language model launched in 2025 immediately appeared on the list of impersonated tools.

“Interestingly, threat actors are rather picky in choosing an AI tool as bait. For example, no malicious files mimicking Perplexity were observed. The likelihood that an attacker will use a tool as a disguise for malware or other types of unwanted software directly depends on the service’s popularity and hype around it. The more publicity and conversation there is around a tool, the more likely a user will come across a fake package on the Internet.

To be on the safe side, SMB employees – as well as regular users – should exercise caution when looking for software on the Internet or coming across too-good-to-be-true subscription deals. Always check the correct spelling of the website and links in suspicious emails. In many cases these links may turn out to be phishing or a link that downloads malicious or potentially unwanted software,” says Vasily Kolesnikov, security expert at Kaspersky.

Another cybercriminal tactic to look for in 2025 is the growing use of collaboration platform brands to trick users into downloading or launching malware. The number of malicious and unwanted software files disguised as Zoom increased by nearly 13% in 2025, reaching 1,652, while such names as “Microsoft Teams” and “Google Drive” saw increases of 100% and 12%, respectively, with 206 and 132 cases.

This pattern likely reflects the normalisation of remote work and geographically distributed teams, which has made these platforms integral to business operations across industries.

Among the analysed sample, the highest number of files mimicked Zoom, accounting for nearly 41% of all unique files detected. Microsoft Office applications remained frequent targets for impersonation: Outlook and PowerPoint each accounted for 16%, Excel for nearly 12%, while Word and Teams made up 9% and 5%, respectively.

The top threats targeting small and medium businesses in 2025 included downloaders, trojans and adware.

Phishing and spam

Apart from malware threats, Kaspersky continues to observe a wide range of phishing and scam schemes targeting SMBs. Attackers aim to steal login credentials for various services — from delivery platforms to banking systems — or manipulate victims into sending them money through deceptive tactics. One example is a phishing attempt targeting Google Accounts.

Attackers promise potential victims to increase sales by advertising their company on X, with the ultimate goal being to steal their credentials.

Beyond phishing, SMBs are flooded with spam emails. Not surprisingly, AI has also made its way into the spam folder — for example, with offers for automating various business processes.

In general, Kaspersky observes phishing and spam offers crafted to reflect the typical needs of small businesses, promising attractive deals on email marketing or loans, offering services such as reputation management, content creation, or lead generation, and more.