Akira and RansomHub shared second place of most active threat group in March, with 62 attacks each.

RansomHub was the second most active ransomware group, with 87 attacks in February 2025.

The second most active ransomware group in December was Clop with 68 attacks, followed by Akira with 43 attacks and RansomHub with 41 attacks.

RansomHub was the most prominent R&DE collective in 2024. RansomHub accounted for approximately 10% of all R&DE incidents ZeroFox observed throughout the year and conducted at least 216 attacks during Q4 2024. In November 2024, RansomHub conducted at least 97 attacks.