How Is Ransomware Evolving: From 5 Gangs To 85 Competitors Fighting For Your Data

How is ransomware evolving? The answer changes your risk model.

Ransomware used to be simple. A few big gangs. Predictable targets.

Now it's a marketplace with eighty-five competitors.

In Q3 2025, researchers tracked a record 85 active ransomware groups, with 14 new groups emerging in that quarter alone. The top ten groups now account for just 56% of all victims, down from 71% earlier in the year.

That's not consolidation. That's fragmentation.

And fragmentation changes everything.

The Numbers Tell A Different Story

Ransomware accounts for 75% of breaches in the System Intrusion attack pattern, according to the 2025 Verizon Data Breach Investigations Report. For small and medium-sized businesses, the impact hits even harder. Ransomware was involved in 88% of SMB data breaches studied.

Monthly victim disclosures now exceed 530 on average. October 2025 spiked to 623 incidents.

The volume stays high despite takedowns. Law enforcement targets infrastructure and core groups, not affiliates. Affiliates migrate quickly or form new groups after disruptions.

Here's what that means in practice. Your threat model just expanded from tracking a handful of sophisticated groups to monitoring dozens of smaller, nimbler actors with varying capabilities and motivations.

Some groups specialize in specific industries. Others focus on particular ransom amounts. A few target companies based on data sensitivity rather than ability to pay.

The marketplace is segmenting.

How Is Ransomware Evolving? Market Dynamics Tell The Story

Think about what happens when a market fragments. Competition increases. Prices drop. Players specialize. Innovation accelerates.

The ransomware market just did exactly that.

Median ransom payments fell to $115,000 in 2024, down from $150,000 in 2023. More significantly, 64% of victims now refuse to pay ransoms, up from 50% two years ago.

Lower payment rates force affiliates to adapt. Some lower demands for smaller targets. Others double down on data theft and exposure, what the industry calls double extortion.

The economics shifted. When fewer victims pay, attackers need more volume or higher-value targets to maintain revenue. That creates two distinct strategies.

Volume players hit easier targets with lower ransoms, betting on scale. Specialists hunt high-value data at larger organizations, where exposure risk justifies higher payments even if encryption fails.

Both strategies increase your exposure.

Volume attacks mean more attempts against your perimeter. Specialist attacks mean deeper reconnaissance and more sophisticated social engineering once they identify valuable data.

What CEOs and Boards Need To Understand

Your team probably has backups. Maybe cyber insurance. Those are table stakes.

But when 85 groups are competing for your data, the question changes from "Can we recover?" to "How much can they expose?"

Encryption is one threat. Exposure is another.

Attackers increasingly steal data before encrypting it. They threaten to publish customer records, financial data, intellectual property, or communications that could damage reputation or trigger regulatory action.

Recovery time matters less when the damage comes from disclosure, not downtime.

At CTO Input, we frame this for CEOs and boards in financial terms. What's the cost if customer data appears on a leak site? What's the regulatory penalty for exposed personal information? What's the competitive impact if product roadmaps or pricing strategies become public?

Those numbers usually exceed the ransom demand by a factor of ten or more.

The risk shifted from operational disruption to financial and reputational exposure. That changes the control framework.

The Blast Radius Framework

Traditional perimeter defense assumes you can keep attackers out. Fragmentation proves that assumption wrong.

With 85 groups probing for entry, the question becomes: When someone gets in, what can they reach?

That's your blast radius.

Reducing blast radius means limiting what an attacker can access, encrypt, or exfiltrate after initial compromise. It requires three focus areas.

Access control and identity management. Most breaches start with credential abuse. Two-thirds of incidents in Q3 2024 involved abuse of valid accounts and missing or lax enforcement of multi-factor authentication, primarily on VPNs and virtual desktop infrastructure.

Enforce MFA everywhere. Review who has privileged access. Segment administrative credentials from user accounts. Treat every login as a potential entry point.

Vendor and third-party risk. Third-party breaches surged to 30% of all cases in 2025, double the 15% rate from 2024. These weren't just software supply chain vulnerabilities. They included credential exposures from partners, misconfigured SaaS environments, and lack of secure-by-default settings.

Map every vendor with system access or data custody. Review their security posture annually. Limit their privileges to exactly what they need. Revoke access immediately when contracts end.

Data minimization and classification. You can't expose what you don't keep.

Identify your most sensitive data. Customer records, financial information, intellectual property, employee data. Know where it lives and who can access it.

Delete what you don't need. Encrypt what you must keep. Restrict access to the smallest group that requires it for their work.

When an attacker compromises one system, they should hit walls everywhere else.

What This Means For Your Operating Model

Understanding how ransomware is evolving means recognizing that fragmentation makes threat intelligence harder. You can't profile 85 groups the way you could track five.

That shifts the strategy from threat-based defense to consequence-based risk management.

Stop asking "Which group might target us?" Start asking "What's valuable enough to encrypt or expose?"

Build controls around your most critical assets. Measure recovery time for essential systems. Quantify financial impact of different exposure scenarios.

Then map your security investments to those consequences, not to the threat actor.

This approach scales better as the marketplace grows. Whether you face group 10 or group 75, the valuable assets stay the same. The blast radius framework stays the same.

The controls that limit exposure to one attacker limit exposure to all of them.

The Governance Question

Ransomware moved from an IT problem to a board-level risk.

When 75% of system intrusion breaches involve ransomware, and 85 groups compete for access, the question isn't whether you'll face an attempt. It's whether your controls will contain it.

That requires executive attention and resource allocation.

I recommend quarterly risk reviews that quantify exposure in financial terms. What's the dollar impact of a three-day outage? What's the cost of exposed customer data? What's the regulatory penalty for compliance failures?

Map your security investments to those numbers. Show the board how each control reduces a specific financial risk.

Then measure progress. Recovery time targets. Access control coverage. Data classification completion. Third-party risk assessments.

Governance means treating security as a continuous operating discipline, not a project or a purchase.

How is ransomware evolving? From predictable threat to fragmented marketplace. Your risk model needs to catch up.

Need help quantifying your ransomware exposure? CTO Input helps boards and leadership teams map blast radius, reduce financial risk, and build governance that scales as the threat landscape fragments. Let's talk.