A few ransomware groups, namely Gentlemen, Qilin and Akira, have become some of the largest and most stable operations in recent months. However, in their shadows lie a series of smaller groups, emerging players, and a fragmentation of the ransomware ecosystem. In recent weeks, several new ransomware groups have emerged and quickly claimed to have attacked dozens of businesses. Halycon’s analysis indicates that around 111 ransomware groups claimed attacks between July and September of this year.
A new group, called Global Secret Group, has claimed responsibility for attacks causing 48 victims, more than half of whom were recorded on the same day, according to analysis by security firm ReliaQuest. Another, called Storm, recorded 71 victims in just 20 days. Not all attacks may be legitimate, but they still create uncertainty for businesses.
“That growth is due, in my view, to this acceleration that AI has brought to these threat actors, essentially allowing them to create their own groups,” says Brandon Tirado, director of threat research at ReliaQuest.
Instead of being beholden to traditional ransomware-as-a-service providers, all researchers Kernel Panic said they have seen more lone wolf operators branching out. Tirado says his team recently managed to identify who is behind a new group and discovered that it was led by an inexperienced teenager who made more than $800,000 in less than two weeks. He declined to give the teen’s name publicly.
Halcyon’s Kaiser agrees that more and more actors are using AI to try to go out on their own with expanded capabilities to deceive targets, exploit vulnerabilities, verify their code, and even compromise other groups’ remote access tools to gain redundant access to a victim in the event that a path is blocked. But she adds that it’s still unclear how successful these newcomers will be in the long term. She suspects that many of them might first arise and then burn out, because they lack the institutional knowledge and expanded resources of an established group.
While established attackers typically carry out “double extortion” attacks in which they deploy traditional ransomware that encrypts a victim’s systems while exfiltrating a target’s data and then threatening to publish it online, those operating independently may be more likely to focus solely on data extortion to simplify their operations.
“The number of attacks recorded this year already exceeds the total number for 2025,” says Liska, “but the number of attacks involving encryption may actually decrease year over year.”
Spot something we should include next week? Let us know at (email protected). And stay safe out there.
Gn bussni
