The Rise of New Ransomware Groups: What to Expect in 2025

In recent years, ransomware has been one of the most prominent threats to global cybersecurity. As the digital landscape continues to evolve, so do the tactics and strategies used by cybercriminals. In 2024, we witnessed a significant increase in ransomware attacks, with a notable surge in the number of new groups entering the scene. This article delves into the explosive growth of ransomware gangs in 2024, highlights the emerging players to watch in 2025, and offers an analysis of how these groups are reshaping the landscape of cybercrime.

the 2024 Ransomware Surge

In 2024, ransomware attacks hit a record high of 5,414 incidents, marking an 11% rise from the previous year. After a slower start, the frequency of attacks surged in the second and fourth quarters, with Q4 alone accounting for 33% of the year’s total. Notably, law enforcement’s crackdown on major groups like LockBit had unintended consequences, sparking fragmentation and increased competition among ransomware groups. As a result, the number of active groups jumped by 40%, from 68 in 2023 to 95 in 2024.

One of the most startling trends was the significant rise in new ransomware groups. In 2023, only 27 new groups emerged, but in 2024, that number more than doubled, with 46 new players entering the field. By the end of 2024, 48 groups were actively engaged in ransomware attacks, a sharp increase compared to previous years. Among these, RansomHub became the dominant force, surpassing even the infamous LockBit in terms of activity. Other noteworthy newcomers included Fog and Lynx, both of which showed substantial promise and potential for growth.

What Undercode Says: A Closer Look at the New Ransomware Landscape

The dramatic increase in the number of ransomware groups signals a major shift in the threat landscape. While the larger, well-established groups like LockBit and Conti have been the most notorious in recent years, law enforcement actions targeting these gangs have created an opening for smaller, more agile groups to step in and capitalize on the disruption.

One key factor driving this increase is the fragmentation of the ransomware ecosystem. As major players face increased scrutiny and enforcement, smaller gangs are emerging to fill the void. These smaller groups are often more nimble, with fewer resources but a greater ability to adapt and innovate. They are less likely to attract attention from law enforcement, allowing them to operate with relative impunity.

Another important aspect of this surge is the increasing sophistication of these groups. While many of the new players are still in their infancy, the use of ransomware-as-a-service (RaaS) platforms has made it easier than ever for even the least experienced cybercriminals to launch devastating attacks. These platforms provide the infrastructure, tools, and knowledge needed to carry out ransomware operations without the need for advanced technical expertise.

Among the new groups, RansomHub stands out as the most significant. This group has rapidly surpassed other major players in terms of activity, becoming a major player in the ransomware world. RansomHub’s success can be attributed to its ability to quickly adapt to evolving security measures and exploit new vulnerabilities. With a growing list of successful attacks, this group is one to watch in 2025.

Fog and Lynx, while not as active as RansomHub, have shown promise in their ability to infiltrate and disrupt organizations. Fog, in particular, has been noted for its targeted approach, carefully selecting high-value victims to maximize its payouts. Lynx, on the other hand, has gained attention for its sophisticated social engineering tactics, using deception and manipulation to infiltrate systems before launching attacks.

As we move into 2025, it’s clear that the landscape of ransomware is changing rapidly. With more groups entering the fray and an increasing number of attacks being launched every day, organizations must be more vigilant than ever. Cybersecurity teams will need to stay ahead of these evolving threats by continually updating their defenses and monitoring for signs of new attacks.

The rise of smaller ransomware groups also underscores the importance of collaboration between private and public sectors. As these groups become more decentralized, they can be harder to track and dismantle. International cooperation will be crucial in the fight against ransomware, as law enforcement agencies must pool their resources and share intelligence to combat the growing threat.

Fact Checker Results:

Increase in Ransomware Attacks: The data showing an 11% increase in ransomware attacks in 2024 is accurate and reflects a growing trend of cybercrime.
Surge in New Ransomware Groups: The number of new ransomware groups more than doubling in 2024 compared to the previous year is also verified, confirming the dramatic rise in cybercriminal activity.
Emerging Players: RansomHub, Fog, and Lynx are indeed the new groups gaining traction, with RansomHub emerging as the dominant force in the ransomware ecosystem.

References:

Reported By: https://thehackernews.com/search?updated-max=2025-03-05T19:38:00%2B05:30&max-results=11
Extra Source Hub:
https://www.digitaltrends.com
Wikipedia: https://www.wikipedia.org
Undercode AI