DragonForce, LockBit, and Qilin, a new triad aims to dominate the ransomware landscape

DragonForce, LockBit and Qilin have formed a ransomware alliance to boost attack effectiveness, sharing tools and infrastructure and signalling a major shift in the threat landscape, according to the article. The piece notes that the alliance could help restore LockBit’s reputation among affiliates after last year’s takedown and may lead to more frequent attacks, including on critical infrastructure.

In Q3 2025, Qilin hit a record number of victims, with the group partnering with initial access brokers for VPN access to enable fast, stealthy attacks. The report also states that active data-leak sites reached a record 81 in Q3 2025, reflecting greater fragmentation in the ransomware ecosystem and a shift towards targeting SMBs.

A quoted report, according to ReliaQuest, says the alliance could drive more frequent and effective attacks and potentially trigger a surge in critical infrastructure and health-care sector targeting. The article further notes that LockBit 5.0 was first advertised on 3 September 2025 and that health care listings surged while smaller groups increased activity in the quarter.