After LockBit, ALPHV Takedowns, RaaS Startups Go on a Recruiting Drive

This report analyzes how recent takedowns and disruptions of high-profile RaaS groups (LockBit, ALPHV/BlackCat) have damaged their credibility with affiliates, leading to a shift toward smaller ransomware-as-a-service startups that advertise better profit splits, trust mechanisms (affiliates controlling wallets), and services. It cites specific incidents—an alleged ALPHV exit scam involving a $22M affiliate payout and law enforcement messaging that undermined LockBit's reputation—and profiles emerging groups (Cloak, Medusa, RansomHub) recruiting disaffected affiliates.