Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns

According to Check Point Research, Q3 2025 saw a record 85 active ransomware and extortion groups, marking the most decentralised ransomware ecosystem to date. Across more than 85 leak sites, operators published 1,592 new victims in Q3 2025, with an average of 535 disclosures per month, and the top ten groups accounted for just 56% of victims, down from 71% earlier in the year.

The period also saw 14 new groups launched in Q3, contributing to a broader wave of independent operations as traditional RaaS hierarchies fracture. LockBit is back in the spotlight with version 5.0, signalling potential re-centralisation after months of fragmentation and attracting renewed affiliate confidence; at least a dozen victims were hit in the first month of its campaign.

The report emphasises how fragmentation is eroding attribution and reducing the perceived credibility of ransom assurances, while suggesting that the landscape could shift further if LockBit succeeds in re-establishing dominance.