Ransomware's Fragmentation Reaches a Breaking Point While LockBit Returns

Key Takeaways:

85 active ransomware and extortion groups observed in Q3 2025, reflecting the most decentralized ransomware ecosystem to date.

1,590 victims disclosed across 85 leak sites, showing high, sustained activity despite law-enforcement pressure.

14 new ransomware brands launched this quarter, proving how quickly affiliates reconstitute after takedowns.

LockBit's reappearance with version 5.0 signals potential re-centralization after months of fragmentation.

In Q3 2025, Check Point Research recorded a record 85 active ransomware and extortion groups , the highest ever observed. What was once a concentrated market dominated by a few ransomware-as-a-service (RaaS) giants has splintered into dozens of smaller, short-lived operations.

This proliferation of leak sites repres