Recommended Free Tools
Ransomware groups can sell services to one another and still compete, retaliate, or try to disrupt one another. Their relationships are usually transactional, not dependable alliances: operators, affiliates, access brokers, and infrastructure providers may all play different roles, and a dispute between any of them can turn into a reported attack. But the evidence does not point to one motive—or show how often these attacks happen.
Ransomware is an ecosystem, not a single gang
In a ransomware-as-a-service (RaaS) arrangement, an operator may develop or maintain ransomware tools and services while affiliates use them to carry out attacks. Other criminals may sell network access or provide infrastructure. These roles can be divided among multiple actors, and one actor may work with different partners over time.
As an Amazon Associate I earn from qualifying purchases.
The UK National Cyber Security Centre (NCSC) describes ransomware activity as a chain in which different functions can be performed and sold by different threat actors. It warns: “Attribution of a ransomware (or other cyber crime) incident to a single responsible actor is often impossible.” That makes apparently simple descriptions of a gang attacking another gang difficult to verify: the people who operate a service, use it, and control affected infrastructure may not be the same.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why cooperation can turn into conflict
Business relationships do not guarantee loyalty
Groups may buy, rent, or provide services because doing so helps them make money. That commercial dependence does not establish trust, a lasting alliance, or an agreement to protect one another. The Canadian Centre for Cyber Security describes the modern ransomware landscape as “a highly sophisticated and interconnected threat ecosystem that is constantly evolving.” In a system built around criminal services and shifting relationships, cooperation and competition can coexist.
Disputes can create incentives to retaliate or disrupt
When actors disagree over money, access, control, or reputation, retaliation or an attempt to disrupt a rival is plausible. A group might also benefit from taking over another group’s public-facing infrastructure or presenting itself as more powerful. These are possible explanations, not established motives for every incident: public reporting rarely reveals enough to determine who acted or why with confidence.
Javvad Malik, Lead CISO Advisor at KnowBe4, told ITPro in September 2026: “When relationships are built on deception and fear, double-crossing and betrayal is always a credible threat.” That is an analyst’s observation about the risks of criminal relationships, not proof that a particular reported takeover resulted from betrayal.
Rank #2
What the reported incidents do—and do not—show
| Incident | What was reported | What remains uncertain |
|---|---|---|
| LockBit infrastructure, May 2025 | A 2026 Broadcom report said LockBit’s infrastructure was hijacked and defaced by an unknown actor, described as “likely a rival ransomware gang.” | The actor was not identified. “Likely a rival” is qualified attribution, not confirmation of who was responsible or why. |
| ShinyHunters and Clop, reported September 2026 | ITPro reported that ShinyHunters claimed to have taken over Clop’s website and infrastructure after a dispute. | This was ShinyHunters’ claim; Clop had not publicly commented in the report. An analyst cautioned that ShinyHunters could benefit from publicity. The report does not independently establish the full scope of any compromise or its motive. |
The reports are not equivalent evidence. The LockBit account attributes the incident to an unidentified actor, with a rival only considered likely; the Clop account centers on a claim by ShinyHunters. Neither establishes a general pattern or a single cause for attacks between criminal groups.
Law-enforcement disruption can reshape the field
Actions against a major group can change the environment for its operators, affiliates, and competitors, but they do not by themselves explain each subsequent incident. The US Cyber Threat Intelligence Integration Center (CTIIC) said the ransomware threat became more fragmented following Operation Cronos, which began targeting LockBit actors and infrastructure in February 2024. Fragmentation describes a change in the broader threat landscape; it is not proof that any particular rival attack was caused by the operation.
Disruption can affect a group’s capacity, reputation, or relationships with affiliates. Leaks and public claims can also change how other criminals perceive a group. Those effects may overlap, and the available reporting does not establish one motive that can be applied to every case.
How common are gang-on-gang attacks?
The available figures do not answer that question. CTIIC counted 2,593 ransomware attacks in 2022, 4,591 in 2023—a 77% year-to-year increase—and 5,289 in 2024—a further 15% increase. These are counts of overall ransomware attacks, not attacks by one criminal group against another. CTIIC defines its cases as claimed or reported events in which actors encrypt or steal data and pressure victims for payment; it also cautions that leak-site and forum-derived reporting may inflate counts.
Separately, the Canadian Centre for Cyber Security reported an average 26% year-over-year increase from 2021 to 2024 in ransomware incidents known to the Cyber Centre, and estimated that average would continue through 2025. That measure is specific to Canada and is not a global count of gang-on-gang attacks. Neither source provides a reliable estimate of how often ransomware groups attack one another.
Free tools Windows power users keep installed
One-click scans. No signup required.
What this means for organizations defending themselves
Rivalries among criminals do not make ransomware victims safer. The same division of labor that complicates attribution can complicate resilience planning: an incident may involve different actors at different stages, and a group’s disruption does not erase the risk of stolen data or ongoing extortion. The Canadian Cyber Centre notes that data theft can make backups insufficient as a sole mitigation.
- Plan for both data encryption and data theft; restoring systems from backups alone may not address exposure or extortion.
- Build incident response around evidence and impact, not just a name claimed by an attacker. Treat public attribution as provisional when the underlying reporting is qualified.
- Assess resilience across people, services, and infrastructure that support critical systems, rather than assuming a single criminal group controls every part of an attack.
The central point is not that ransomware gangs are in a constant “civil war.” That phrase is a news framing, not a technical category. The better-supported picture is a shifting criminal ecosystem in which commercial cooperation, competition, disruption, and uncertain attribution can all exist at once.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
