Ransomware Cartels Reshape Cybercrime Into Industrial Supply Chain

The ransomware landscape has undergone a structural transformation. What was once a fragmented ecosystem of competing criminal gangs has consolidated into cartel-style alliances that share infrastructure, tools, and affiliates across brand lines. The result is an industrialized cybercrime supply chain that is more resilient, more scalable, and significantly harder to disrupt than anything that came before it.

The Cartel Era Begins

In September 2025, DragonForce posted a proposal on dark web forums that would have been unthinkable just two years earlier. The group called for a formal coalition with LockBit and Qilin, two of the most established ransomware-as-a-service operations in the world. The pitch was simple: stop competing, start collaborating, and dictate market conditions together.

LockBit agreed. By the third quarter of 2025, threat intelligence firm ReliaQuest was tracking shared infrastructure, tools, and data-leak resources connecting all three operations. The coalition invited other groups to join, framing the alliance as a survival strategy in an increasingly challenging environment for cybercriminals.

This was not a merger. Each group continues to operate its own ransomware variant and leak site. Instead, the arrangement functions as a criminal supply chain where tools, access brokers, and affiliates move freely between brands. An affiliate who gains initial access through social engineering can shop that access to any cartel member, each offering different encryption capabilities, negotiation support, and revenue splits.

Why Consolidation Happened Now

The cartel formation was driven by two converging pressures. First, law enforcement disruptions have become more aggressive and more effective. The February 2024 takedown of LockBit through an international operation code-named Operation Cronos seized infrastructure, arrested members, and publicly unmasked the group’s alleged leader. That operation significantly eroded affiliate trust in LockBit, which had been the dominant ransomware brand for years.

Second, competition among ransomware-as-a-service providers intensified dramatically. Groups began offering increasingly generous affiliate splits to attract talent. Qilin advertises an 85/15 revenue split with affiliates. LockBit offers up to 90 percent for top performers. DragonForce provides an 80 percent cut alongside its white-label model, which allows affiliates to operate under their own branding rather than DragonForce’s, making individual attacks harder to attribute.

The cartel structure resolves both problems. By cooperating rather than competing, the groups eliminate the downward pressure on affiliate cuts. And by pooling resources, they create a more resilient infrastructure that can absorb law enforcement actions without collapsing.

The Supply Chain Attack Vector

One of the most dangerous consequences of cartel consolidation is the industrialization of supply chain attacks. Rather than targeting individual organizations one at a time, ransomware groups increasingly compromise trusted intermediaries such as managed service providers and software distributors to reach thousands of downstream victims in a single operation.

This one-to-many attack vector has become a top priority for ransomware groups in 2026. The logic is straightforward: compromising one MSP can open doors to dozens or hundreds of its clients, each representing a potential ransom payment. The cartel structure amplifies this efficiency because access obtained by one group’s affiliate can be shared across the entire coalition.

Data from Black Kite’s 2026 ransomware report underscores the scale. The report documented 7,551 ransomware victims disclosed during the year, with second-half volume accelerating 60 percent above the first-half pace. Manufacturing led all sectors for the fourth consecutive year with 1,660 victims, accounting for 22 percent of all disclosures. Professional, scientific, and technical services followed with 1,389 victims.

Multi-Extortion Tactics Standardized

The cartel era has also standardized multi-extortion tactics. Simple encryption is no longer the primary threat. Modern ransomware operations layer multiple pressure mechanisms to force payment even when organizations maintain reliable backups.

• Data theft and leak threats: Attackers exfiltrate sensitive data before encrypting systems, then threaten public disclosure if the ransom is not paid.
• DDoS attacks: Some groups launch distributed denial-of-service attacks against victim infrastructure to increase operational pressure and demonstrate capability.
• Direct stakeholder harassment: The Finnish psychotherapy provider Vastaamo breach demonstrated this tactic when attackers individually extorted thousands of patients after the primary organization refused to pay.
• Regulatory pressure: The Black Cat group filed an SEC complaint against victim MeridianLink for failing to report a cyberattack within four days, weaponizing compliance obligations against the victim.

DragonForce has taken this further with its Data Analysis Service, which automates risk audits of stolen datasets and generates tailored extortion scripts, draft executive letters, and regulatory-threat talking points. This service is available to affiliates targeting organizations with more than $15 million in annual revenue, effectively productizing the extortion process.

AI Accelerates Attack Speed

The integration of artificial intelligence into ransomware operations has compressed the window between vulnerability disclosure and active exploitation from weeks to hours. AI-powered phishing campaigns generate context-aware, personalized messages that are grammatically flawless and virtually indistinguishable from legitimate communications. Voice deepfakes have already been used to authorize fraudulent transfers, including a $25 million heist targeting a multinational firm in Hong Kong.

For defenders, this means the traditional patch management cycle is no longer adequate. Organizations that rely on monthly or quarterly patching schedules are operating with exposure windows that attackers can exploit within hours of a CVE publication. The cartel structure compounds this risk because vulnerability exploitation capabilities are now shared across multiple groups rather than siloed within a single operation.

Geographic Shift in Victim Distribution

The 2026 data reveals a significant geographic shift. The United States remained the largest single target at 49.3 percent of all victims, but that share fell from 51.9 percent even as the raw US victim count rose 19 percent. Europe grew faster across the board.

Germany rose 48 percent to 281 victims. Italy surged 96 percent to 188 victims. Spain and France both grew by roughly half. This expansion reflects the cartel’s multilingual capabilities and broad targeting strategy, which Qilin in particular has developed to operate flexibly across both Western and Asian markets.

The revenue profile of victims has also shifted. Organizations in the $50 million to $100 million revenue band climbed from 25.1 percent to 29.3 percent of victims with known revenue, the biggest jump of any band. The $100 million-plus tier actually fell from 13.9 percent to 9.5 percent. Large enterprises have not stopped being targeted, but mid-market organizations have become the primary growth engine for ransomware volume.

Defensive Strategy for the Cartel Era

Organizations must adapt their defensive posture to account for the cartel’s shared infrastructure and accelerated attack timelines. Several measures are critical:

• Identity infrastructure hardening: Compromised credentials remain the primary initial access vector. Implement multi-factor authentication on all remote access points, including RDP, VPN, and cloud admin consoles. Monitor for credential stuffing and password spray attacks, which increased tenfold in early 2024 and have continued to accelerate.
• Supply chain risk management: Audit the security posture of MSPs and software vendors. Require evidence of security controls, incident response plans, and breach notification timelines in vendor contracts. Segment third-party access to limit lateral movement if a vendor is compromised.
• Accelerated patching: Move to a risk-based patching model that prioritizes internet-facing vulnerabilities. For critical CVEs, target remediation within 48 hours rather than the traditional 30-day window.
• Backup resilience: Modern ransomware groups specifically target backup infrastructure to eliminate recovery options. Maintain immutable, air-gapped backups that cannot be modified or deleted by attackers with domain administrator credentials.
• Tabletop exercises: NCC Group and other security firms recommend regular tabletop exercises to identify gaps in incident response plans before a real attack exposes them. Include scenarios involving multi-extortion tactics such as data leak threats and regulatory reporting obligations.
• Zero trust architecture: Reduce the blast radius of any compromise by implementing least-privilege access controls, network microsegmentation, and continuous verification of user and device identity.

The Path Forward

The ransomware cartel model represents a maturation of the cybercrime economy. By sharing infrastructure, pooling affiliate talent, and coordinating attack strategies, these groups have created a criminal supply chain that is more resilient to law enforcement disruption and more efficient at scale than the fragmented gang model that preceded it.

For defenders, the implications are clear. The threat is no longer a single group with a single toolkit. It is an interconnected ecosystem where capabilities, access, and intelligence flow freely between allied operations. Defensive strategies must account for this interconnectedness. Isolating and disrupting one group no longer meaningfully degrades the overall threat landscape when that group’s tools and affiliates can simply migrate to a coalition partner.

Organizations that continue to treat ransomware as a point threat rather than a supply chain threat will find themselves outpaced. The cartels have industrialized their operations. Defenders must industrialize their resilience.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous