Active Ransomware Groups Reached a Record 124 in 2025

Tracking of the 2025 ransomware ecosystem recorded a record 124 active groups, of which 73 were newly identified. A separate count put the figure at 138 groups.

Seventy-three new entrants in twelve months is not a market where starting an operation is hard. Ransomware-as-a-service supplies the tooling, the negotiation infrastructure and the leak site; an entrant supplies willingness and access.

And the access is purchasable. The credential markets at 25-0620, the stolen support-portal routes at 25-0105, the exploited edge appliances at 25-0805 — an operation can begin without any capability to find its own way in.

It is tempting to read a scattered ecosystem as a weakened one. The corpus does not support that.

For defenders, threat intelligence organised by group becomes less useful as the number of groups approaches the number of incidents. Indicators, playbooks and named-actor advisories all assume a manageable set of adversaries with stable behaviour.

For victims in negotiation, a small unknown group has no reputation to protect and no track record of honouring agreements — which makes the already worthless suppression transaction at 25-0507 worse still.

For investigators, a hundred small operations present a hundred separate cases rather than one target whose disruption matters.

A "new group" is generally a new leak-site brand. Rebranding after attention, splintering from a disrupted operation, and affiliates operating under their own name all produce new brands without new people.

Two trackers reporting 124 and 138 for the same year illustrates that the unit is not well defined. Graded medium: the direction is consistent across sources, and the population being counted is brands rather than organisations.