The Alliance That Wasn’t: A Critical Analysis of ReliaQuest’s Q3 2025 Ransomware Report

According to ReliaQuest's Threat Spotlight: Ransomware and Cyber Extortion in Q3 2025, the groups LockBit, DragonForce, and Qilin had allegedly formed a cooperative “alliance” sharing software, resources, and affiliates to boost their operational reach. However, the article asserts there is no verifiable basis for this claim, noting the absence of technical indicators, digital forensics, or credible primary sources supporting shared code, infrastructure, or collaboration.

It warns that the unverified assertion spread rapidly across media outlets and was often treated as established fact. The piece highlights that ZeroFox offered the only cautious analysis, emphasising that the rumored coalition had not materialised and urging caution against uncorroborated claims. Marco A. De Felice is quoted as having contacted all three groups and obtaining a denial from Qilin regarding any alliance or cartel, with the piece inviting readers to consider what real evidence, if any, exists. The overall tone labels the alliance claim as speculative and unverified, urging careful scrutiny of such narratives.