The global cyber threat landscape is undergoing a radical transformation, moving away from monolithic ransomware cartels toward highly volatile, fragmented splinter groups, a top UK police official has warned.
Speaking at Infosecurity Europe 2026, William Lyne, Head of Economic and Cybercrime at the Metropolitan Police Service, told IT and security leaders that the modern cyber crime ecosystem has evolved into a highly accessible space.
Lyne compared the underground landscape to a bar where threat actors can “get everything but a good drink.”
“It felt like cyber threats were all quite stovepiped. You had hacktivists, you had hostile state actors,” Lyne explained, reflecting on his early career. Today, however, those lines have blurred. “Those kind of stovepipes… no longer really exist.”
Instead, Lyne described a blended ecosystem of products, goods, and services that has dramatically lowered the barrier to entry for prospective criminals.
This shift has been heavily accelerated by cryptocurrencies, which solved the traditional criminal bottleneck of “cashing out.”
Previously, threat actors lost up to 75% of their profits navigating complex, expensive money-mule networks. Today, cryptocurrency allows them to realize illicit gains almost instantly and with very little risk.
Fragmentation and the ‘post-trust’ era
While massive international law enforcement operations have successfully dismantled groups like LockBit and disrupted phishing as a service (PhaaS) platforms, Lyne cautioned that the criminal underground is rapidly adapting.
“It’s getting more diverse… [and] also much more fragmented,” Lyne said. Following high-profile law enforcement crackdowns, cybercriminals have realized that operating as a massive, centralized brand or ransomware as a service scheme is “actually quite bad for business.”
Lyne told attendees the cyber crime landscape is becoming more fragmented and volatile.
(Image credit: ITPro/Rene Millman)
As a result, major ransomware operators are breaking off into smaller, independent factions.
This fragmentation is leading to a dangerous “post-trust” trend within the criminal ecosystem. Without the strict moderation and internal rules previously enforced by large cartel administrators, smaller threat actors are exhibiting more extreme, aggressive, and unpredictable behaviors.
The demographics of these attackers are also shifting. Lyne noted that the threat landscape is moving beyond traditional Russian-speaking hubs to include actors from Brazil, Türkiye, and English-speaking groups like the notorious Scattered Spider collective.
AI weaponizing hoarded data
Addressing the inevitable topic of AI, Lyne dispelled fears of autonomous systems launching end-to-end cyber attacks, but highlighted a pressing new risk for enterprise data privacy.
“These guys are generally not innovative,” Lyne noted, explaining they only change their methods if they are “systematically earning less money… or they spy an opportunity to make more money.”
Having stolen and hoarded petabytes of corporate data over the last decade, data that was rarely deleted even when victims paid the ransom, cyber criminals are now using AI tools to operationalize these massive “treasure troves” and mining historic datasets for new extortion and revenue streams.
Rewriting the law enforcement playbook
Faced with this agile, commoditized threat, the Met Police and its international partners are adopting aggressive new disruptive strategies.
“We can’t arrest our way out of this problem,” Lyne admitted, citing the jurisdictional complexities of cross-border cybercrime.
Instead, policing has shifted toward systemic disruption, psychological operations designed to undermine criminal trust, and targeting the foundational infrastructure of the cybercrime supply chain.
Crucially, this requires unprecedented collaboration with the private sector. Lyne emphasized that the Met Police is increasingly sharing intelligence with enterprise IT security teams and even naming industry partners who assist in operations on their site takedown pages.
“Ultimately, like, lots of these things just come down to trust,” Lyne concluded, addressing the security professionals in the room.
“We want to have meaningful, both strategic and tactical collaboration with industry partners that we know hold some of the keys to… the challenges that we have in this space. The cultural change that we have undertaken, I think will continue so that we collaborate better moving forward.”
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
