Key Findings Record fragmentation and decentralization: The number of active extortion groups in Q3 2025 rose to a record of 85 groups, the highest number observed to date. The top 10 groups accounted only for 56% of all published victims, down from 71% in Q1. Stable high activity: Ransomware victim postings stabilized at an average of 535 victims per month, up from 420 year-over-year (YoY) in Q2–Q3 2024, but below the Q1 2025 peak. LockBit’s return: Lockbit’s reappearance with the release of LockBit 5.0 in September 2025 potentially signals affiliate re-centralization under a major brand Emerging dominance: Qilin became the most active group, averaging 75 victims per month, followed by Akira, INC Ransom, and Play. Regional concentration shifts: South Korea entered the top 10 list of most…