Ransomware Landscape: Fragmentation and New Threats Emerge

In Q3 2025, ransomware continues to evolve with a notable fragmentation of groups, leading to a decentralized ecosystem. According to The Hacker News, a record 85 active ransomware and extortion groups were observed, which is the highest number recorded to date.

These groups collectively disclosed 1,590 victims across various leak sites, indicating sustained activity despite ongoing law enforcement pressure. Interestingly, only 56% of these victims were attributed to the top ten groups, a significant drop from 71% earlier in the year, highlighting the rise of independent operations.

The report noted that 14 new ransomware brands launched in just this quarter, showcasing how quickly affiliates can regroup after major takedowns. This fragmentation has made the ransomware landscape more unpredictable, as security professionals can no longer rely on tracking a few dominant groups.

Instead, they face a multitude of smaller, short-lived operations that complicate attribution and reduce the reliability of intelligence based on reputation. Law enforcement's impact appears limited, as dismantling infrastructure often fails to address the affiliates who carry out the attacks.

When large groups are disrupted, their operators quickly migrate or rebrand, creating a more resilient ecosystem. The return of LockBit, with its version 5.0, raises questions about potential re-centralization within this fragmented landscape.

LockBit's resurgence is marked by enhanced technical capabilities, including updated variants and unique negotiation portals for victims. This resurgence demonstrates a renewed confidence among affiliates, who may prefer the structure offered by established brands over smaller operations.

Should LockBit manage to consolidate power again, it could lead to larger, more coordinated attacks, increasing the risks for potential victims. Additionally, the report highlighted the changing dynamics in target selection, with the United States remaining the prime target for financially motivated actors, while South Korea entered the top ten due to targeted campaigns against financial institutions.

The manufacturing and business services sectors were notably affected, each representing about 10% of recorded cases, with healthcare also maintaining a steady number of incidents. As ransomware adapts to shifting market pressures, the key takeaway for cybersecurity professionals is the necessity to monitor the mobility of affiliates, infrastructure overlaps, and the economic incentives driving these attacks.

The landscape is characterized by a structural resilience that indicates law enforcement efforts alone are insufficient to curb the growth of ransomware, necessitating a shift in strategies for cybersecurity defense.

As the ransomware ecosystem continues to decentralize, analysts must adapt to the complexities of this new reality to effectively address the evolving threat landscape.