Explainer: What’s driving the rapid rise in new ransomware groups?

The number of organisations named on leak sites rose by 30 per cent in 2026’s third quarter, which is an alarming figure in its own right, but, according to new research from cyber security firm ReliaQuest, newcomer cyber extortion groups are driving the activity.

Fully 93 per cent of that 30 per cent increase was attributed to groups that only emerged in that quarter.

However, just because attacks are being publicised by these emerging threat groups doesn’t mean they ever took place.

“It’s realistically possible their listings mix new attacks, rebrands, recycled data, and unsupported claims – posting patterns varied widely, from steady weekly listings to dozens dumped in a single day, and one group surfaced weeks after a similarly named group went quiet,” ReliaQuest said in a blog post outlining its research.

“For example, a data set posted by ‘ExfilSquad’ contained low-risk workforce and customer relationship details that looked like they likely came from exposed credentials, not a network breach. It didn't substantiate the implied breach or explain how the data was obtained.”

It’s a trend that Cyber Daily has observed not just in the last quarter, but for the better part of the year. New groups are emerging on a nearly weekly basis, but just because they sound new, contends Rapid7’s Christiaan Beek, doesn’t mean that they are…

VIEW ALL

"What we are seeing is not necessarily the sudden emergence of dozens of completely new criminal organisations. Increasingly, a new ransomware name does not mean a new ransomware operation,” Beek told Cyber Daily.

“The ransomware ecosystem is becoming more like a platform economy. Established Ransomware-as-a-Service operators provide the infrastructure, tooling, negotiation capabilities and sometimes even the leak infrastructure, while affiliates can move between platforms or operate under their own brands. That makes it much easier for an experienced criminal crew to appear as a 'new group' without having to build an entire ransomware operation from scratch.”

RaaS operators, such as Qilin – currently the world number one in terms of victim count – are effectively force multipliers for emerging threat actors and experienced ones alike. Some groups, such as DragonForce, even advertise that affiliates can operate under their own brand and with their own leak infrastructure, further lowering the barrier for entry into the ecosystem.

That said, it’s important to take a close look at how many of these groups are operating, and if they are really traditional ransomware actors at all.

“There is also an important distinction in the latest data: several of these new names are primarily data-extortion or data-broker groups rather than traditional ransomware operators,” Beek said.

“If encryption is removed from the business model, the technical barrier to entry becomes even lower: steal the data, establish a leak site and use publication as leverage.”

And, of course, there is the matter of AI, and its impact on attacker behaviour, although Beek takes pains to point out that he sees criminal use of AI as “a force multiplier rather than the root cause.”

“AI can lower the cost of developing tooling, analysing targets, creating phishing content, translating communications and automating parts of an intrusion or extortion process,” he said.

“We are now even seeing early examples of agentic AI being used during ransomware operations. That potentially allows much smaller teams to operate at a level that previously required significantly more expertise and manpower.”

ThreatLocker’s CEO, Danny Jenkins, agrees that AI is letting less-skilled groups compete with more advanced ones.

“I think AI is the biggest contributor here, because, if you think about five years ago, you had to have a certain skill set to be a ransomware group. You had to know how to write malware. You had to know how to set up a service. You had to know how to host the web page… And all of that can now be automated through various AI agents,” Jenkins said.

“And you don't even need to be a tech. You can be an accountant, and you can set up a ransomware group. So I think one of the biggest driving factors behind new ransomware groups appearing is just… You don't need the skill set to do this anymore. There is a manual out there that you could just download and use and create and change and update and be dynamic.”

Regardless, Beek urges caution when evaluating new threat actors.

“I would be careful interpreting every new ransomware brand as a new threat actor,” Beek said.

“What we may actually be seeing is the ransomware ecosystem fragmenting into many smaller brands sitting on top of a much smaller number of shared criminal platforms, developers, access brokers, and experienced affiliates."