5 RaaS groups that should be on businesses’ radars

As ransomware continues to proliferate, ransomware-as-a-service (RaaS) is now firmly rooted in the ecosystem. Some operations come and go, such as LockBit, which was taken down in 2024 after a multi-jurisdictional law enforcement effort dubbed Operation Cronos.

Yet LockBit continues to reinvent itself and has recently relaunched, alongside a busy market of RaaS rivals with various targets and aims.

In the current climate, some operations pose more of a risk to businesses than others. Here are five RaaS groups businesses should be aware of – according to current research and threat intelligence – along with some steps firms should take to mitigate the threat.

Akira

Akira operates on an affiliate RaaS structure, with a long lineage associated with storied Russian cybercrime syndicates.

Akira is objectively considered a “semi-private offering”, maintained by “an eclectic cartel of experienced ransomware operators”, according to Brown.

TTPs vary and are indicative of the techniques applied by individual affiliate operators themselves, says Brown. For example, he says, Akira ransomware shares direct source code overlap with previous Conti ransomware payloads.

Operating since 2023, Akira is notable for expanding beyond traditional Windows environments and targeting virtualisation infrastructure, including VMware ESXi and Nutanix AHV environments, says Mertens.

Mitigation

To protect against attacks from Akira, authentication logs are “a good starting point”, says Mertens. Organizations should look for successful VPN connections from unusual locations or devices, dormant accounts suddenly becoming active, or “accounts authenticating to systems they normally never use”.

DragonForce

DragonForce emerged publicly in 2023 and has evolved from a conventional operation into what it describes as a ransomware ‘cartel’. It was responsible for 2025 retail attacks including M&S and the Co-op.

The group reflects a “broader trend” in which affiliates, access brokers and ransomware operators share infrastructure, tooling and expertise, says Mertens.

DragonForce affiliates’ intrusion patterns include credential compromise, reconnaissance, lateral movement, data theft, and encryption. Double extortion is “central to its model”, according to Mertens.”

“Attackers typically steal sensitive information before encrypting systems, allowing them to threaten publication of stolen data, even if victims can recover from backups

Mitigation

To defend against the group, firms should monitor both the intrusion and exfiltration stages of an attack, says Mertens.

“Unusual PowerShell activity, credential dumping, new remote-access tools and unexpected SMB or RDP activity can indicate an attacker establishing control of the environment.”

Organizations should also watch for large archive files, unexpected use of tools such as 7-Zip or RAR, and abnormal outbound transfers, he says. “Exfiltrating large volumes of data takes time and can provide an opportunity to detect the intrusion before encryption begins.”

LockBit 5.0

LockBit suffered a steep drop in activity following Operation Cronos, but researchers say it has now returned to roughly fourth place in the last year. This shows “the difficulty in clamping down on ransomware if the people involved remain at large”, says Heasley.

Originally identified as ABCD ransomware, a moniker derived from the file extension applied to the files the ransomware encrypted, LockBit originated in the Russian-speaking cybercrime underground around September 2019.

While the threat from the group has fallen sharply since its heyday, LockBit-associated adversaries continue to release updated builders and remain “a prevalent threat”, says Brown.

Mitigation

Mitigating attacks from LockBit affiliates requires ensuring a robust defence. Heasley mandates “a combination of phishing-resistant multi-factor authentication (MFA) on every internet-facing service, offline and immutable backups regularly tested, and network segmentation to slow lateral movement in the event of a breach”.

Qilin

Qilin emerged in mid-2022 when established RaaS brands such as Conti, LockBit, BlackCat/ALPHV, and Hive were experiencing disruption from law enforcement actions, leaks, or internal fragmentation.

Amid the chaos, the Russia-linked group positioned itself as a “professional affiliate program”, recruiting experienced operators from other syndicates and offering a revenue-sharing model, explains Adam Brown, principal threat intelligence analyst at Huntress.

The now-infamous group caused havoc in 2024 when it was responsible for the attack on NHS provider and blood testing company Synnovis.

Today, Qilin is still keeping itself busy. The group is “unquestionably the most active RaaS operation of the last year”, according to Cian Heasley, principal consultant, Acumen Cyber. Some statistics show the outfit was involved in one in every six disclosed ransomware breaches across the top 50 countries impacted by ransomware between April 2025 and March 2026.

Mitigation:

Qilin affiliates typically gain access via VPN accounts, exploiting an internet-facing appliance, or credentials from another criminal. Therefore, rather than concentrating solely on Qilin signatures, organizations should monitor for unusual VPN logins, unexpected Active Directory enumeration, suspicious Local Security Authority Subsystem Service (LSASS) access, and remote administration activity, according to Xavier Mertens, principal instructor, SANS Institute.

“A workstation suddenly querying large parts of Active Directory, an administrator account authenticating to dozens of servers, or PsExec appearing where it has never previously been used can all indicate an intrusion in progress. The combination of these behaviours is often more revealing than any single alert.”

The Gentlemen

The Gentlemen, which emerged in mid-2025, consists of highly organized former affiliates of other massive ransomware networks such as Qilin. The group has become notorious for its aggressive double extortion model and a unique 90% profit split payout offered to affiliates, which has helped fuel its rise.

The Gentlemen typically gains initial access by exploiting internet-facing edge devices, according to Christiaan Beek, VP of Rapid7 Labs at Rapid7. “Once inside, the Gentlemen ransomware affiliates conduct reconnaissance to map the environment and identify high-value targets for encryption and data exfiltration.”

The Gentlemen is currently the second most active RaaS, based on statistics from reported breaches, according to Heasley.

Mitigation

To defend against The Gentlemen, it’s crucial that a patch management program prioritizes fixes to network edge devices as they are released, says Beek. “Prioritization of fixes should also be based on known exploits, the potential impacts on your business, and how these align with your risk tolerance.”

Heasley believes the strongest defence against The Gentlemen lies in disrupting the group's kernel-level endpoint detection and response (EDR)-killing playbook by enabling Microsoft's vulnerable driver blocklist.

At the same time, he recommends “removing internet exposure from firewall management interfaces and protecting backup infrastructure with credentials and controls that sit entirely outside your production Active Directory”.