A Desperate Cartel: Inside the Unlikely Alliance of Qilin, DragonForce, and a Fading LockBit

Three of the ransomware world’s most notorious groups—Qilin, DragonForce, and the once-dominant LockBit—have reportedly formed a “cartel” in a September 2025 announcement, with DragonForce posting on a Russian underground forum. According to Yarix Intelligence Team, the alliance may be more about the survival of a fading brand than genuine operational synergy, and the report notes that LockBit has been completely inactive since June.

The analysis highlights a broader shift away from traditional ransomware as a service, with a 65% drop in ransom payments observed in Q3 2025 and fewer victims willing to pay. It suggests affiliates are migrating away from declining groups, and that Qilin has benefited most from the publicity, becoming the most active group in October 2025.

The report also questions whether the cartel is a true merger or a reputational survival strategy for LockBit, as it struggles to stay relevant while banned from major forums and facing internal challenges linked to Operation Cronos. Overall, the piece frames the development as signalling a turning point in which the era of a single untouchable ransomware giant is giving way to a fractured, survival-driven landscape.