Ransomware gangs are multiplying fast, with Q3 2025 seeing a record 85 active groups, the highest ever recorded, according to new data from Check Point Research.

The cybersec firm’s latest State of Ransomware update describes a ransomware ecosystem defined by the fragmentation of traditionally dominant gangs, replaced by an abundance of loosely affiliated or solo operators shifting from ‘plug-and-play’ RaaS kits to self-run campaigns.

Monitoring 85 active data leak sites, Check Point said that more than half (47) published fewer than ten victims, suggesting that the closure or dormancy of major RaaS brands like RansomHub and 8Base are driving smaller operators to launch solo attacks.

According to the report, fourteen new threat groups began publishing victims over Q3’25, bringing the total number of newly observed actors over the year to 45.

This new era of decentralised ransomware means that over the last quarter, the top ten ransomware groups accounted for just 56% of all published victims, down from 71% at the start of the year.

As strange as it sounds, Check Point said that the splintering of the ransomware ecosystem is undermining trust between attackers and victims. While established “brands” have a commercial incentive to honour decryption promises, today’s swarm of short-lived operators often don’t – leading to a drop in payment rates.

Check Point said it had identified around 535 victims per month over Q2-Q3 2025, a gradual increase from the 420 per month in the same period of 2024 – evidence of both a plateau in activity and the limited impact of high-profile law enforcement operations. 

Of the most active gangs, Qilin once again emerged as top dog, averaging 75 victims per month and observed recruiting former RansomHub affiliates, cementing its reputation as the year’s most relentless ransomware threat. 

Other notable players over Q3 included well-established players like Akira, INC Ransom, and Play, while newer groups like Warlock and The Gentlemen built on a flurry of early activity. Warlock, which began posting victims only in June, reached 43 victim listings in Q3, while The Gentlemen claimed 38 victims in September alone. 

Meanwhile, DragonForce, the high-profile gang linked to the M&S cyber-attack, showed steady growth, but still fell behind Qilin and Akira in victim count. 

Check Point said that the group’s recent claims of a coalition with Qilin and LockBit have been revealed as largely symbolic, suggesting the group was using a “marketing strategy” to maintain its visibility and credibility in a highly competitive RaaS market.

The instability of the threat landscape could soon end, however, with the re-emergence of RaaS giant LockBit, a group which dominated the scene until being disrupted in 2024 by Operation Cronos.

Recommended reading

• M&S Cyber-attack Stoking Fears Across British Businesses
• Retail Sector Cyber-attacks Peaked in Q2 2025
• Report: Half of Firms Hit by Months-Long Cyber-attack Disruption

Check Point said that the release of “Lockbit 5.0” in September, when it asked new affiliates to for a Bitcoin deposit of roughly $500 to access its services, marked the gang’s return to active operations, and suggested that smaller players might soon consolidate around the long-standing brand.

Since then, the report claims that researchers have identified fifteen victims, mostly in the US, who have been taken by LockBit 5.0, with updated ransom notes including a unique “personal identifier” for each victim to access a negotiation portal. Customer service at its best.

“The ransomware ecosystem in Q3 2025 remains highly active and structurally fragmented, while at the same time increasingly adaptive,” concluded the report.

“The dissolution of major RaaS programs did not reduce the overall volume of attacks but instead redistributed the load among numerous smaller and more agile actors.

“Groups such as Qilin and DragonForce have capitalised on this trend, expanding through aggressive affiliate recruitment and service innovation. LockBit’s re-emergence signals a potential trend toward re-centralisation around trusted brands.”

Join the Conversation

Don’t miss DIGIT Expo 2025 on 27 November at the EICC Edinburgh – Scotland’s largest tech showcase featuring 5 stages of keynotes, 60+ exhibitors and networking with 1,700+ IT & digital professionals.

Secure your free ticket now: Register here