Ransomware attacks have spiked over the past year, with near-weekly incidents making the headlines, but according to the latest report from ReliaQuest, these threat actors could soon evolve into a more aggressive, coordinated force, hinting at a dangerous new phase for the cyber-criminal ecosystem.

The cyber firm’s latest Ransomware and Cyber Extortion roundup details the surprising coalition of three prominent Ransomware-as-a-Service (Raas) groups over the last quarter, with the newly returned LockBit uniting with DragonForce and Qilin to escalate their global attacks.

According to ReliaQuest, this unholy partnership is poised to deliver more frequent and effective cyber-attacks, with each group expected to share at least some of their tactics, techniques and resources, potentially triggering a surge of attacks.

ReliaQuest researchers said that the alliance could also help LockBit’s attempts to rebuild its reputation following last year’s takedown, with the group potentially looking to emulate the success of previous collaborations, like that with Maze in 2020, which introduced double extortion tactics to heighten pressure on victims.

Added to that, LockBit is pushing boundaries by greenlighting strikes on critical industries once deemed off-limits, another example of the group’s retaliation against law enforcement, according to the report, which puts previously low-risk industries at greater risk.

“If the group manages to rebuild its trust among affiliates, it could reemerge as a dominant ransomware threat, driven by financial motives and by a desire for revenge against law enforcement crackdowns,” warn ReliaQuest researchers.

Also making fresh waves is the Scattered Spider threat group, a loose collective of young, English-speaking hackers originally linked to the M&S hack.

After tracking the group’s activity, ReliaQuest said that Scattered Spider is likely gearing up to release its first RaaS offering, ‘ShinySp1d3r RaaS’, combining the collective’s social engineering expertise with disruptive encryption.

The move marks a major evolution for Scattered Spider, but also could be pivotal for English-native cyber-criminals, who, ReliaQuest said, until now have relied on Russian-speaking providers that are often reluctant to work with their Western counterparts.

But as veteran ransomware groups evolve their tactics, a new wave of threat actors is rising and have an agenda of their own.

Recommended reading

• Are AI Chatbots Sending You to Phishing Sites?
• Deepfake Fraud Explodes 2,000% In Three Years
• Report: Dark Web Flooded with 500% Increase in Stolen Credentials

Over the last quarter, ReliaQuest found new groups like Beast, Cephalus, and The Gentlemen had contributed to a 31% rise in attacks against the healthcare sector, blowing past more established ransomware ‘families’ like Qilin and Inc Ransom.

Meanwhile, the top-targeted sectors in Q3, professional, scientific, and technical services, saw a 17% increase in ransomware incidents, a recurrence of the trend in threat actors targeting sensitive data like intellectual property and financial records via smaller, often poorly defended organisations.

“As we reflect on Q3 2025, the ransomware landscape has undergone a dramatic transformation. With the fall of once-dominant groups like RansomHub, smaller, fragmented ransomware actors have surged, introducing unique and unpredictable targeting patterns,” concludes the report.

“The threat landscape is shifting rapidly, and ransomware is set to become an even greater challenge for defenders.”