LockBit, Qilin, and DragonForce Join Forces to Dominate the Ransomware Ecosystem

Three prominent ransomware groups—DragonForce, LockBit, and Qilin—have announced a strategic alliance, signalling a shift towards more coordinated and resource-rich attacks, according to ReliaQuest’s ransomware report for Q3 2025.

The collaboration is expected to enable sharing of techniques, resources and infrastructure, potentially strengthening each group’s operational capabilities and, if affiliates rebuilt trust after past takedowns, driving a surge in incidents across critical infrastructure and previously lower-risk sectors. ReliaQuest notes a jump to 81 data leak sites from 51 reported in early 2024, with professional, scientific and technical services accounting for the largest share of victims, surpassing 375.

The partnership follows LockBit’s return and comes as Qilin, described as the most active ransomware group in recent months, claimed a little over 200 victims in Q3 2025. At its peak, LockBit targeted more than 2,500 victims worldwide and amassed over $500 million in ransom payments. The developers’ alliance emerges as LockBit 5.0, advertised on 3 September 2025, targets Windows, Linux and ESXi systems, underscoring the evolving threat landscape.