Ransomware-as-a-service ecosystem splinters into 85-group market in Q3 2025
Threat Actor Meta
Summary
Hide ▲
Show ▼
Q3 2025 marked a major ransomware ecosystem shift as 85 active groups and 14 new brands pushed the market toward fragmentation. The change raises risk because former affiliates and short-lived crews make attribution, tracking, and negotiation less reliable. It also shows that takedowns have not reduced overall volume; they have redistributed operators across more leak sites. A possible countertrend is the return of LockBit 5.0, which could recentralize part of the market if affiliates rally around a trusted brand.
Related Happenings
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor Meta
First: 31.03.2026 15:15
Last: 31.03.2026 15:15
Sources 1
About this happening:
TeamPCP and **Vect ransomware group** are linking **supply-chain compromises** to **follow-on ransomware campaigns**, broadening extortion risk for affected organizations. The shi...
TeamPCP and Vect partner to turn supply-chain compromises into ransomware follow-on campaigns
Threat Actor MetaAbout this happening: TeamPCP and **Vect ransomware group** are linking **supply-chain compromises** to **follow-on ransomware campaigns**, broadening extortion risk for affected organizations. The shi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor Meta
First: 19.03.2026 18:00
Last: 19.03.2026 18:00
Sources 1
About this happening:
**hastalamuerte** exposed the internal workings of **The Gentlemen** ransomware group, revealing a **Qilin-related RaaS split** that shows how affiliate-driven ecosystems can rapi...
The Gentlemen RaaS split exposed by hastalamuerte
Threat Actor MetaAbout this happening: **hastalamuerte** exposed the internal workings of **The Gentlemen** ransomware group, revealing a **Qilin-related RaaS split** that shows how affiliate-driven ecosystems can rapi...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
Target Trend
First: 17.03.2026 23:41
Last: 17.03.2026 23:41
Sources 1
About this happening:
**Ransomware operators** are increasingly leaning on **built-in Windows tooling** while **ransom payment rates** continue to decline across **2025**, weakening extortion returns f...
2025 Ransomware trend toward built-in Windows tooling and lower ransom payment rates
Target TrendAbout this happening: **Ransomware operators** are increasingly leaning on **built-in Windows tooling** while **ransom payment rates** continue to decline across **2025**, weakening extortion returns f...
Phobos long-running ransomware-as-a-service operation and broad distribution
Threat Actor Meta
First: 17.02.2026 13:31
Last: 17.02.2026 13:31
Sources 1
About this happening:
**Phobos** remains a **long-running ransomware-as-a-service** operation linked to the **Crysis** family, with a broad affiliate ecosystem that has driven repeated intrusions world...
Phobos long-running ransomware-as-a-service operation and broad distribution
Threat Actor MetaAbout this happening: **Phobos** remains a **long-running ransomware-as-a-service** operation linked to the **Crysis** family, with a broad affiliate ecosystem that has driven repeated intrusions world...
Latest development: 05.03.2026 10:34
Evgenii Ptitsyn pleaded guilty to wire fraud conspiracy for administering Phobos ransomware, a long-running RaaS operation linked to the Crysis ransomware family. The U.S. Department of Justice says Phobos collected more than $39 million in ransom payments from over 1,000 public and private entities worldwide, and Ptitsyn was extradited from South Korea in November 2024 before the plea.
DragonForce shifts ransomware-as-a-service into a cartel-style affiliate umbrella
Threat Actor Meta
First: 05.02.2026 00:14
Last: 05.02.2026 00:14
Sources 1
About this happening:
**DragonForce** has shifted into a **cartel-style ransomware-as-a-service model**, letting affiliates launch their own brands while sharing a common umbrella. That change expands...
DragonForce shifts ransomware-as-a-service into a cartel-style affiliate umbrella
Threat Actor MetaAbout this happening: **DragonForce** has shifted into a **cartel-style ransomware-as-a-service model**, letting affiliates launch their own brands while sharing a common umbrella. That change expands...
Timeline
-
14.11.2025 12:37 2 articles · 6mo ago
Ransomware-as-a-service ecosystem splinters into 85-group market in Q3 2025
Initial DisclosureBy **Q3 2025**, enforcement pressure had fractured the ransomware market into smaller crews, while former affiliates kept launching new brands and leak sites.
Show sources
- Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns — thehackernews.com — 14.11.2025 12:37
- Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns — thehackernews.com — 14.11.2025 12:37