3 Extortion Gangs Join Forces in Ransomware 'Cartel'

Three of the biggest names in ransomware and data extortion have announced a cartel-style collaboration, with LockBit, Qilin and DragonForce inviting others to join their coalition to share attack information and resources.

The coordination is described as a coalition aimed at jointly developing their direction, according to the report from ReliaQuest titled “Ransomware and Cyber Extortion in Q3 2025.” The piece notes that the alliance could enable technique, resource and infrastructure sharing, potentially strengthening each operation’s capabilities, though the impact remains to be seen. Analysts also point to historical precedents, such as LockBit’s 2020 collaboration with Maze that popularised double extortion.

Some observers suggest the move could backfire for DragonForce, as continuing links to LockBit might complicate payments from victims in jurisdictions where such activity is sanctioned. Defenders are urged to continue best practices like using trusted endpoint protection, applying patches, and tightening remote access to curb any evolving threats.