Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns
Summary: Check Point Research recorded 85 active ransomware and extortion groups in Q3 2025, the highest ever observed, with 14 new groups beginning to publish that quarter and 45 for the year to date. Many of these smaller crews emerged from the collapse of RansomHub, 8Base and BianLian, while LockBit 5.0 returned in September 2025 under administrator LockBitSupp and hit at least a dozen victims in its first month.
Why it matters: Takedowns of RansomHub and 8Base did not reduce ransomware volume, and payment rates estimated at 25 to 40 percent keep falling as victims lose trust in attacker promises. If LockBit's brand reputation pulls affiliates back into a single program, the result is easier tracking but the return of coordinated campaigns that dozens of ephemeral crews cannot execute.
Read the original at The Hacker News ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·