The ransomware landscape of 2025 is defined by a resilient ransomware-as-a-service ecosystem that reconstitutes itself faster than law enforcement can dismantle it.

Key facts

• Established brands like LockBit and ALPHV/BlackCat were disrupted, but affiliates migrated to groups such as RansomHub.
• Active operations include RansomHub, Akira, Play, Qilin, Medusa, Black Basta, BlackSuit and Cl0p.
• Double extortion, stealing data and threatening to leak it, is now standard.
• Most attacks still begin with stolen credentials, unpatched vulnerabilities or exposed services.

What it means for defenders

Tracking individual group names matters less than addressing the root causes they all exploit: leaked credentials, missing MFA, unpatched CVEs and exposed services. Continuous dark web monitoring gives defenders early warning across every brand.

How DarkThreatX helps

DarkThreatX monitors the dark web for breached records, leaked credentials and threat-actor activity tied to your organisation. Run a free dark web scan or explore the platform.