Following the disruption of the largest ransomware-as-a-service operation, reporting describes Akira, PLAY and RansomHub rapidly absorbing its market share, with overall attack rates continuing to rise.
Displacement Is The Default Outcome
An affiliate is not employed by a platform. They hold access to victim networks and choose which service to monetise it through, on terms comparable to selecting any other supplier.
Disrupting the platform does not remove the access, the skills or the intent. It removes one option from a list. The affiliate switches, and the switching cost is close to zero.
This desk filed the same structure at 26-0626 and 26-0302; what the 2025 data adds is that the transfer was fast enough to be visible in the same reporting period.
What It Means For How Disruption Is Scored
Success against a named operation is reported as a reduction in that operation’s activity, which is measurable and true. Whether total activity fell is a different question, usually unasked because it is harder and the answer is less satisfying.
A defensible statement is that disruption imposes cost and friction on the ecosystem. A statement that it reduces attacks requires evidence the corpus does not have — the counterfactual problem at 25-1222.
Where The Analogy To Legitimate Markets Breaks
In a lawful market, removing the dominant supplier raises prices and reduces volume, because capacity is expensive to replace.
Here the capacity is software. A competing platform can absorb an unlimited number of new affiliates at essentially no marginal cost, which is why the volume did not fall and why the corpus should stop expecting it to.
Built on published ecosystem reporting, listed below, read against the enforcement files in this database. Market-share characterisations are drawn from leak-site tracking with the limitations set out at 25-1230. Corrections: corrections@forensicpost.com.