New Research Uncovers the Alliance Between Qilin, DragonForce and LockBit

The report covers an announced September 15, 2025 alliance between ransomware groups DragonForce, Qilin, and LockBit and analyzes 2025 ransomware ecosystem trends: a 61% YoY increase in claims (Jan–Nov 2025), a decline in top-group market share, a 65% drop in median ransom payments in Q3 2025 (to ~USD 140,000) with only 23% of victims paying, Qilin emerging as the most active group (13.07% of claims) with a post-announcement surge, DragonForce showing steady growth, and LockBit remaining largely inactive since February 2024—concluding the coalition may be symbolic but could boost recruitment and activity.