In recent months, several ransomware groups have gained notoriety within the cybersecurity landscape, with prominent names such as Gentlemen, Qilin, and Akira leading the charge. However, alongside these established operations, a surge of smaller, emerging groups has created a more fragmented ransomware ecosystem. Halcyon’s analysis indicates that between July and September of this year, around 111 distinct ransomware groups claimed to have executed attacks on various businesses.
A noteworthy newcomer, identifying itself as the Global Secret Group, has reported attacks on 48 victims, with more than half of these incidents occurring in a single day, according to an analysis from security firm ReliaQuest. Another group named Storm has listed 71 alleged victims within just 20 days. While the legitimacy of all reported attacks is uncertain, their emergence contributes to an increasing atmosphere of risk for businesses.
Brandon Tirado, director of threat research at ReliaQuest, attributes this growth to the acceleration provided by artificial intelligence (AI), which seems to enable these threat actors to establish their own independent operations. This trend diverges from the traditional “ransomware-as-a-service” model, as researchers have noted a rise in lone operators venturing into the ransomware sector. For instance, Tirado’s team recently traced one new group to an inexperienced teenager, who reportedly earned over $800,000 in less than two weeks, although Tirado refrained from disclosing the individual’s identity.
Halcyon’s Kaiser echoes these observations, emphasizing that more actors are leveraging AI to enhance their capabilities, allowing them to manipulate targets, exploit vulnerabilities, assess their code, and even access competitors’ remote-access tools to secure redundant pathways into victims’ systems. However, she cautions that the long-term success of these new entrants remains uncertain, as they may experience an initial spike in activity followed by burnout due to a lack of institutional knowledge and resources compared to established groups.
Established ransomware actors often engage in “double extortion” tactics, where they encrypt victims’ systems while simultaneously exfiltrating sensitive data and threatening to publish it online. In contrast, independent operators may prefer focusing solely on data extortion, streamlining their operations for efficiency.
According to Recorded Future’s research, the total number of attacks observed this year significantly surpasses the total for all of 2025. Nonetheless, there is a possibility that the incidence of encryption-related attacks may decline year over year.
Given the sophisticated nature of these attacks, various tactics from the MITRE ATT&CK framework could have been employed. Possible techniques include initial access through phishing or exploiting unpatched vulnerabilities, persistence via malware installation, and privilege escalation to gain further control over affected systems. As the landscape evolves, business owners must remain vigilant and proactive in enhancing their cybersecurity measures to mitigate these emerging threats.
As the frequency and complexity of ransomware attacks increase, staying informed and prepared is vital. Business owners should remain aware of these developments to protect their operations and sensitive data from potential incursions.