Dark Reading has written an article discussing the simultaneous rise in total number of ransomware victims and fall in number of victims affected by major ransomware gangs, which suggests a growing number of smaller ransomware operators having success in the market.

Twenty-eight ransomware groups were observed claiming victims in May. However, Lockbit, the market leader, saw a thirty percent decline in victims since April. These new groups include 8Base, Malas, Rancoz, and BlackSuit, who are pursuing new behaviors in extortion in order to maximize their profits. The emergence of Rorschach as an alternative to Lockbit is a microcosm of this shift, as Rorschach only appeared in April and has already demonstrated new and more advanced capabilities compared to LockBit, including in the most important metric of time-to-encrypt victim’s machines. In this time of significant shifts in the criminal ransomware economy, members are recommended to maintain heightened awareness until a new equilibrium is found. CISA’s StopRansomware page is an authoritative resource on the latest actor groups and guidance documents to aid critical infrastructure organizations toward greater ransomware resilience. Read more at Dark Reading.