Ransomware Surge in August: NCC Group Counts 83 Active Gangs

A record month, by the numbers

Ransomware activity climbed sharply in August, reaching its highest level of the year so far, according to new research from NCC Group. 1 The firm's tracking logged 1,073 incidents for the month and counted 83 distinct ransomware groups operating. That is up from a peak of 70 groups recorded in June. 2

The rise in incidents is the headline. The more useful finding is NCC Group's own reading of what is behind it. The firm's senior analysts argue that the jump looks less like a technological leap and more like a crowded marketplace. In their view, it reflects ransomware-as-a-service (RaaS) brands multiplying and new entrants joining the field, rather than attacks being supercharged by artificial intelligence. 2

Not an AI story, at least not yet

This matters because a popular narrative has formed over the past couple of years. It holds that generative AI is lowering the barrier to cybercrime and fueling surges like this one. NCC Group's analysts push back on that framing directly. They characterize August's growth as a product of market fragmentation, not AI-accelerated intrusion. 2

That distinction is more than academic. If AI were the main driver, defenders might expect faster, more sophisticated, or more novel attacks. Those would demand new detection approaches. If the growth comes mainly from more operators using familiar RaaS tooling, the threat looks more conventional. It is still serious, but it is the kind of problem that existing hygiene, patching, backup discipline, and access controls are designed to address. Put simply, the data point to more attackers rather than smarter ones. 2

None of this rules out AI playing some role at the margins. Criminals adopt useful tools like anyone else. But the leading explanation from the people compiling the figures is structural rather than technological. Vendors, policymakers, and journalists inclined to attribute every uptick to AI should take note.

Fragmented, yet top-heavy

At first glance, the data seem to pull in two directions. On one hand, the number of active groups has grown, which suggests a more fragmented ecosystem. On the other, a handful of brands account for a large share of the activity. 2

Qilin stands out. The group was tied to 164 of August's 1,073 incidents, roughly 15% of the total on its own. Clop, Dire Wolf, and INC Ransom each racked up dozens of attributions as well. 2 So the growth is not spread evenly across all 83 groups. It is concentrated among a few prominent RaaS operations. 2

One reasonable way to square this is to picture a market with a long tail. A small number of established brands do most of the volume. Meanwhile, a growing fringe of newer or smaller operators each contributes a modest number of attacks. The RaaS model encourages exactly this shape. Successful platforms attract affiliates and scale up. When groups splinter, rebrand, or get disrupted, their members and code tend to resurface under new names. That pushes up the group count without necessarily adding new capability.

What it means for defenders

For security teams, two practical points stand out.

• Concentration offers focus. When one group accounts for around 15% of observed incidents, threat intelligence on its typical access methods and tactics is especially valuable. The same goes for the next tier of prolific operators. 2
• Fragmentation complicates attribution. A field of 83 groups, many of them new, means more names to track and more churn in tactics at the edges. That can make it harder to predict which group, or which variant, an organization might face. 2

The broader takeaway is that the ransomware economy is still expanding and that its business model keeps attracting participants. A single month's spike does not establish a lasting trend. Still, reaching a new yearly high in August suggests the problem is not easing. 1

The reading

The most defensible interpretation of August's numbers is unglamorous. Ransomware is growing because the RaaS franchise model keeps drawing new operators, while a few dominant brands keep doing high volume. AI may become a bigger factor later. For now, the people closest to the data see a crowded criminal market, not a machine-driven one. 2 For defenders, the fundamentals remain the priority, along with close attention to the handful of groups responsible for a large share of the damage.