INTEL-10: The Ransomware Swarm

The INTEL  

The ransomware ecosystem didn’t grow in 2025. It fragmented.

IBM X-Force identified 109 active ransomware groups — a 49% increase year-over-year — but the critical shift isn’t the number. It’s the redistribution. The share of activity attributed to top-tier operators is declining. The cartel model that dominated ransomware for the last five years is being replaced by a swarm: many smaller operators conducting lower-volume attacks using leaked toolkits, commoditized playbooks, and frequent identity shifts to evade attribution.

Red Canary’s detection data across 4.5 million protected assets confirms this from the defender side — the threats triggering alerts aren’t novel. They’re known techniques deployed at volume by numerous smaller groups using off-the-shelf weapons.

Why It Matters  

Most enterprise ransomware strategies are built to defend against a handful of sophisticated, well-resourced groups. Track their TTPs, build detection rules for their custom tooling, monitor their infrastructure. That model assumed a concentrated threat landscape where intelligence-led defense was viable.

With 109 groups — and growing — that model is breaking. Attribution is harder when groups shift identities frequently. Signature-based detection fails against operators reusing generic, leaked toolkits. And the volume of simultaneous low-sophistication attempts overwhelms threat hunting teams optimized for deep investigation of a few campaigns. The threat isn’t more sophisticated. It’s more numerous.

What To Do  

Shift from attribution-based detection to behavior-based detection of commodity attack patterns. Your ransomware playbooks should assume unknown ransomware families using generic techniques, not named groups with documented tooling. Build automated containment that triggers on file encryption behavior patterns — not threat intelligence signatures. Optimize for speed of response over depth of analysis. With 109 groups competing for victims, the selection criteria aren’t strategic. They’re opportunistic. The organizations that get hit are the ones that are slowest to contain.

MITRE ATT&CK  

• T1486 — Data Encrypted for Impact: Commodity ransomware deployment using leaked toolkits across fragmented operator groups
• T1190 — Exploit Public-Facing Application: #1 initial access vector (44% increase) — opportunistic scanning by numerous smaller groups
• T1078 — Valid Accounts: Credential-based initial access enabling low-sophistication ransomware operators

Learn More  

• IBM X-Force Threat Intelligence Index 2026 — Primary source
• Red Canary Threat Detection Report 2026 — Primary source
• FIR Risk Tuesday E86 — Castles on Quicksand — Full dual-report analysis

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.