For years, paying a ransom carried an unspoken bargain: large ransomware brands had a reputation to protect, so they usually delivered a working decryptor and stayed quiet afterwards.
That bargain is weakening as ransomware-as-a-service (RaaS) splinters into dozens of small, short-lived groups.
This article explains what fragmentation looks like in the data, why it undermines ransomware recovery through payment, and how to build a recovery plan that does not depend on a criminal keeping its word.
It is written for incident responders, CISOs and IT leaders who may have to make, or advise on, a ransom decision under pressure.
What ransomware fragmentation looks like in 2025-2026
Law enforcement disruption of large programmes, including the 2024 operation that took down LockBit’s infrastructure, pushed affiliates to scatter. Many moved to other programmes or launched their own brands.
Check Point Research reported that in Q3 2025 a record 85 active groups were tracked on leak sites, with 14 new groups appearing in that quarter alone.
The top 10 groups accounted for 56% of victims, down from 71% in Q1 2025, and 47 groups posted fewer than ten victims each. Check Point described it as the most decentralised ransomware ecosystem it had recorded.
Not every brand is shrinking
Fragmentation sits alongside a few large, stable operations. The same Check Point data showed Qilin averaging about 75 victims a month in Q3 2025 and offering affiliates up to an 85% revenue share.
Its infrastructure choices, such as the bulletproof hosting described in reporting on how Qilin show stability, help it keep leak sites and negotiation portals online.
LockBit’s return as LockBit 5.0, covered in LockBit is back from the dead, and analysis of how the ecosystem consolidates around LockBit alumni, Qilin and newer brands suggest a mixed picture: a long tail of small actors alongside a handful of dominant programmes.
Why fragmentation undermines ransomware recovery
A ransom payment buys two promises: a decryptor that works and deletion of stolen data. Both depend on the attacker’s incentives.
FactorEstablished RaaS brandSmall or short-lived groupReputation incentiveHigh; future victims check track recordLow; brand may vanish within monthsDecryptor qualityUsually tested across many victimsOften untested, buggy or partialData deletion promiseUnverifiable, but brand has some reason to keep quietUnverifiable, and data may be resold or re-extortedNegotiation continuityPortal and contacts persistPortal may disappear mid-negotiationSanctions screeningBetter-known attributionAttribution unclear, making due diligence harder
Check Point warned directly that small, transient groups have less reputational reason to provide decryptors after payment, which lowers the chance of getting data back.
Affiliate churn adds another failure mode: an affiliate who leaves a programme may still hold stolen data, and a different group may later reuse it for a second extortion attempt.
Decryptor reliability in practice
Even a cooperative attacker’s decryptor is a hazard. Incident responders commonly report decryptors that are slow on large file servers, fail on files encrypted during a crash, or corrupt virtual machine disks. The following practices reduce that risk:
Test any decryptor in an isolated environment on copies of encrypted files before running it at scale.
Scan the decryptor binary; treat it as untrusted code from a criminal.
Decrypt to new storage rather than in place, so a failed run does not destroy the only copy.
Check whether a free decryptor already exists through law enforcement or the No More Ransom project.
How fragmentation changes the ransom decision
Victims are already paying less often. Coveware data reported by SecurityWeek showed only 23% of victims paid in Q3 2025, a record low, with the median payment down 65% to $140,000. Better backups, insurer pressure and distrust of attacker promises all contribute.
Where payment is still on the table, fragmentation should change how the decision is made. Questions to answer before any payment:
Can we recover without paying? Confirm backup integrity first; this is the only answer fully under your control.
Who is the actor? Use threat intelligence and your incident response firm to identify the group and its record of delivering working decryptors.
Is payment lawful? The US Treasury’s OFAC advisory on ransomware payments (2021) warns that paying sanctioned actors can carry penalties. Unclear attribution makes this harder.
What does payment actually buy? If the main threat is data publication, payment does not guarantee deletion.
Have we engaged law enforcement? The FBI and CISA may have decryptors, intelligence on the group or seizure opportunities.
Any payment also requires buying cryptocurrency on short notice. Finance teams that check a live bitcoin price feed during negotiations will see that price swings can change the real cost within hours, which is one more reason to decide policy before an incident rather than during one.
Building ransomware recovery that does not depend on attackers
The reliable answer to an unreliable criminal market is to need it less. CISA’s #StopRansomware Guide recommends offline, encrypted backups of critical data and regular testing of backup availability and integrity, noting that many ransomware variants actively seek out and delete reachable backups.
Immutable and isolated backups
Attackers target backup consoles first. Reporting on Gentlemen ransomware disabling Windows Defender and destroying backups is a typical example; MITRE ATT&CK tracks this as Inhibit System Recovery (T1490), alongside Data Encrypted for Impact (T1486).
ControlWhat it protects againstMappingObject lock or WORM storage in compliance modeDeletion or encryption of backup copies by a compromised adminCIS 11.3; CSF PR.DSSeparate identity domain for backup administration with phishing-resistant MFADomain admin compromise spreading to backupsCIS 6.5, 11.3; CSF PR.AAOffline or logically air-gapped copyRansomware reaching every online systemCIS 11.4; CSF PR.DSRegular restore tests with timed recovery objectivesBackups that exist but cannot be restored in timeCIS 11.5; CSF RC.RPBackup of identity systems (Active Directory, IdP configuration)Being unable to authenticate to restore anything elseCSF RC.RP
Illustrative recovery runbook
The following sequence is illustrative and should be adapted to your environment and legal advice.
Contain: isolate affected segments, disable compromised accounts and block known command-and-control.
Preserve evidence: capture memory and disk images from key systems and save ransom notes and negotiation portal details.
Verify backups: confirm the last clean restore point by checking for persistence mechanisms and attacker accounts in backed-up identity data.
Rebuild identity first: restore or rebuild domain controllers and the identity provider in a clean environment.
Restore by business priority: bring back tier-0 and revenue-critical systems from clean images, then data.
Reset credentials: rotate all privileged credentials, service accounts and the KRBTGT account twice.
Monitor for re-entry: watch for the initial access route; many intrusions start at exposed edge devices, as in reporting on ransomware gangs attacking enterprise VPNs.
Planning for data extortion as well as encryption
Fragmentation also increases the risk that stolen data circulates beyond the original attacker. Recovery planning should therefore include legal, regulatory and communications workstreams, not only IT restoration.
Pre-agree with counsel how breach notification decisions will be made, independent of any payment.
Monitor leak sites and criminal forums for your data for months after the incident, not only during negotiations.
Prepare customer and regulator communications that do not rely on the attacker’s deletion promise.
Reduce what can be stolen through data minimisation and network segmentation (CIS Controls 3 and 12).
Rehearse the decision before you need it
Run a tabletop exercise at least once a year that forces executives to work through the payment questions above with incomplete information.
Record who has authority to approve or refuse payment, which outside firms will be called, and what recovery time the business can tolerate.
Teams that have rehearsed this are far less likely to treat payment as the default when systems go dark.
Key takeaways
RaaS has fragmented into a record number of smaller groups, while a few large brands such as Qilin remain stable.
Small, short-lived groups have less incentive to deliver working decryptors or keep data private, which weakens recovery through payment.
Ransom decisions now need actor-specific intelligence, sanctions screening and a clear view of what payment can and cannot buy.
Immutable, isolated and regularly tested backups, including identity systems, are the most dependable ransomware recovery path.
Treat data extortion as a separate risk that payment does not resolve.
FAQ
Does paying a ransom guarantee recovery?
No. Decryptors can fail or be slow, groups can disappear mid-negotiation, and there is no way to verify that stolen data was deleted.
What is a ransomware affiliate?
An affiliate is a criminal who breaks into victims and deploys a RaaS operator’s ransomware in exchange for a share of the ransom. Affiliates often move between programmes.
How do immutable backups help with ransomware recovery?
Immutable backups cannot be changed or deleted for a set retention period, even by an administrator account, so attackers who gain admin access cannot destroy them.
Is it illegal to pay a ransomware demand?
Paying is not generally illegal in the US, but paying a sanctioned person or entity can violate OFAC rules. Legal advice and law enforcement contact are essential before any payment.
What should be restored first after a ransomware attack?
Identity infrastructure such as Active Directory or the identity provider usually comes first, because almost every other system depends on it for authentication.
Click Here For The Original Source.
——————————————————–
