Data-Leak Sites Surge to Record Levels Amid Scattered Spider RaaS and LockBit 5.0 Rise

Ransomware threats are driving data-leak sites to record levels, with the number of active platforms reaching 81 in Q3 2025. The report notes a sharp shift as English-speaking Scattered Spider teased its first RaaS, ShinySp1d3r RaaS, while LockBit returned with LockBit 5.0, explicitly authorising affiliates to attack critical infrastructure. A coalition between LockBit, DragonForce, and Qilin has heightened global risk, and new groups expanded into regions such as Thailand, which saw a 69 percent surge in listings.

In late August 2025, Scattered Spider hinted at releasing its RaaS via a ransom-note image on Telegram, and DragonForce activity earlier in 2025 included ransomware deployed against retail, insurance and aviation targets. The article also reports that active data-leak sites rose from 72 in Q2 to 81 in Q3 2025, with Devman2 listing 22 organisations in Thailand after previously averaging fewer than 10 per quarter. Overall, these seismic shifts underscore ransomware’ s evolving landscape and the need for robust defences.