A few ransomware groups—namely, the Gentlemen, Qilin, and Akira—have emerged as some of the most prominent and stable operations in recent months. However, in their shadow is a range of smaller groups, emerging actors, and fragmentation of the ransomware ecosystem. In recent weeks, multiple new ransomware groups have appeared and quickly claimed to have attacked dozens of businesses. Halycon’s analysis says around 111 ransomware groups made claims of attacks between July and September this year.
One new group calling itself Global Secret Group claimed attacks on 48 victims, with more than half of these being listed on the same day, according to security firm ReliaQuest’s analysis. Another, called Storm, listed 71 victims in just 20 days. Not all of the attacks may be legitimate, but they still cause uncertainty for businesses.
“That growth has all happened because, in my eyes, this acceleration that AI has provided to these threat actors, essentially allowing for them to go out and start their own groups,” says Brandon Tirado, the director of threat research at ReliaQuest.
Instead of being beholden to traditional “ransomware-as-a-service” providers, all of the researchers Kernel Panic spoke to say they have seen more lone-wolf operators branching out. Tirado says his team recently managed to identify who is behind one new group and found that it is being run by an inexperienced teenager who has made more than $800,000 in under two weeks. He declined to name the teen publicly.
Halcyon’s Kaiser agrees that more actors are using AI to attempt to strike out on their own with expanded capabilities to trick targets, exploit vulnerabilities, check their code, and even compromise other groups’ remote-access tools to gain redundant access to a victim in case one avenue gets blocked. But she adds that it’s still not clear how successful these upstarts will be long-term. She suspects that many of them may surge initially and then burn out, because they don’t have the institutional knowledge and expanded resources of an established group.
While established attackers typically conduct “double extortion” attacks in which they deploy traditional ransomware that encrypts a victim’s systems while also exfiltrating a target’s data and then threatening to publish it online, those operating independently may be more likely to focus solely on data extortion to simplify their operations.
“The number of attacks that Recorded Future has seen this year already dwarfs the total number for 2025,” Liska says, “but the number of attacks involving encryption may actually decrease year over year.”
Spotted something we should include next week? Let us know at [email protected]. And stay safe out there.
