Ransomware’s New Look: Rise of Small Cyber Gangs

The ransomware scene is undergoing a transformation, sparked by law enforcement’s crackdown on large-scale criminal operations. As these major groups are dismantled, a swarm of smaller, nimble gangs is rising up. According to MalwareBytes, 41 new ransomware groups have emerged between July 2024 and June 2025, marking a new high in the number of these active threats. This has coincided with a significant increase in ransomware attacks, doubling over the past three years.

The ease of access to malware, abundant cybercrime knowledge, and advanced AI tools have lowered barriers for these new entrants. Despite law enforcement’s success in dismantling operations like LockBit and BlackCat, the void left behind is quickly filled by new groups eager to make a name. Interestingly, these new groups often recycle leaked code from past operations, with SafePay being one such example linked to LockBit’s source.

Fragmentation and Distrust in the Cybercrime World

The downfall of large Ransomware-as-a-Service (RaaS) models has added a layer of complexity. Recorded Future’s Allan Liska warns that open affiliate networks are vulnerable to infiltration, pushing criminals towards smaller, more isolated groups or driving them to start their own. As a result, the prominence of major RaaS has waned—MalwareBytes notes that top gangs now account for just half of all incidents.

The trust issues among cybercriminals have further divided these networks. Tactics by law enforcement have fostered suspicion, leading to infighting and scams. John Fokker from Trellix likens the situation to a Mexican standoff, where everyone is wary of betrayals. This climate encourages smaller operations, leading to a fragmented, dynamic, and, ironically, more unpredictable ransomware landscape for authorities and victims alike.

Stay informed and stay secure! Visit Qsentinel for timely updates and expert advice on navigating the cybersecurity landscape.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.