Rocketing number of ransomware groups as new, smaller players emerge

"The number of active ransomware groups has reached a record high, with new, smaller groups sliding under the radar. In its latest quarterly Ransomware & Cyber Threat Report, GuidePoint's research and intelligence team said they'd seen a 57% increase in the number of ransomware groups, rising from 49 in the third quarter of 2024 to an all-time high of 77 now. The number of victims, though, has remained relatively steady, stabilizing at around 1,500-1,600 per quarter since the last quarter of last year."

""Ransomware activity has settled into a new normal, averaging 1,500 to 1,600 victims per quarter since late 2024," said Nick Hyatt, senior threat intelligence analyst at GuidePoint Security. "Yet while overall activity has stabilized, the number of distinct ransomware groups has surged to a record 77 - highlighting both the consolidation of skilled operators within major RaaS (ransomware as a service) platforms and the ongoing churn of emerging or lower-skill actors entering the ecosystem.""

"The Qilin ransomware group was particularly busy. Its activity surged 318% year-over-year, claiming 234 victims this quarter; Akira was next, with 130 victims, the team said. IncRansom, which first emerged in August 2023, showed a sudden surge in activity during the third quarter, making them the third most active group. The team said it's not clear whether IncRansom will keep this level of activity up."

Active ransomware groups have risen 57%, from 49 to 77, reaching a record high while quarterly victim counts stabilized at roughly 1,500–1,600. The United States accounted for 56% of victims, with Germany at 5% and the UK at 4%. Manufacturing, technology, and legal sectors were most targeted; manufacturing saw 252 publicly claimed attacks in the second quarter, a 26% quarter-over-quarter increase. Major operators within RaaS platforms coexist with a churn of lower-skill actors entering the ecosystem. Qilin surged 318% year-over-year with 234 claimed victims; Akira claimed 130 victims. Emerging groups like IncRansom and SafePay showed variable activity and global reach.

Read at IT Pro