{
  "catalogue_coding": {
    "support_codes": null,
    "programme_entries": 9,
    "alleged_nonpayment_items": 9,
    "depth": "Catalogue classifications only; full original support/recipient/nonpayment semantics have not been independently re-adjudicated. Composite catalogue items are not independent incidents."
  },
  "version": "1.3",
  "published_date": "2026-10-31",
  "title": "Inside the Ransomware Economy",
  "creator": "Brandefense Research Team",
  "source": "Brandefense Blackhole",
  "period": {
    "start": "2026-01-01",
    "end": "2026-10-27",
    "timezone": "UTC",
    "label": "1 January–27 October 2026",
    "partial_month": "2026-10",
    "sampled_period": {
      "start": "2026-07-22",
      "end": "2026-07-28"
    }
  },
  "summary": {
    "claims": 9203,
    "groups": 177,
    "core_groups": 33,
    "core_claims": 5950,
    "core_share_pct": 64.7,
    "top_two_claims": 2158,
    "top_two_share_pct": 23.4,
    "one_month_groups": 50,
    "one_month_claims": 260,
    "multi_relay_claims": 7862,
    "multi_relay_share_pct": 85.4,
    "median_relay_spread_hours": 1.293,
    "excluded_claims": 190,
    "alias_duplicates_removed": 171,
    "recruitment_posts": 12,
    "split_posts": 6,
    "programme_ads": 9,
    "negotiation_support_ads": null,
    "reviewed_posts": 60
  },
  "monthly": [
    {
      "month": "2026-01",
      "label": "Jan",
      "claims": 784,
      "active_groups": 58,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-02",
      "label": "Feb",
      "claims": 793,
      "active_groups": 60,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-03",
      "label": "Mar",
      "claims": 963,
      "active_groups": 62,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-04",
      "label": "Apr",
      "claims": 844,
      "active_groups": 60,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-05",
      "label": "May",
      "claims": 761,
      "active_groups": 63,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-06",
      "label": "Jun",
      "claims": 820,
      "active_groups": 69,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-07",
      "label": "Jul",
      "claims": 874,
      "active_groups": 66,
      "partial": false,
      "sampled": true
    },
    {
      "month": "2026-08",
      "label": "Aug",
      "claims": 1321,
      "active_groups": 92,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-09",
      "label": "Sep",
      "claims": 954,
      "active_groups": 85,
      "partial": false,
      "sampled": false
    },
    {
      "month": "2026-10",
      "label": "Oct",
      "claims": 1089,
      "active_groups": 85,
      "partial": true,
      "sampled": false
    }
  ],
  "groups": [
    {
      "group": "qilin",
      "label": "Qilin",
      "claims": 1146,
      "active_months": 10,
      "share_pct": 12.45
    },
    {
      "group": "thegentlemen",
      "label": "The Gentlemen",
      "claims": 1012,
      "active_months": 10,
      "share_pct": 11.0
    },
    {
      "group": "akira",
      "label": "Akira",
      "claims": 412,
      "active_months": 10,
      "share_pct": 4.48
    },
    {
      "group": "incransom",
      "label": "incransom",
      "claims": 386,
      "active_months": 10,
      "share_pct": 4.19
    },
    {
      "group": "dragonforce",
      "label": "dragonforce",
      "claims": 330,
      "active_months": 10,
      "share_pct": 3.59
    },
    {
      "group": "lockbit5",
      "label": "lockbit5",
      "claims": 281,
      "active_months": 10,
      "share_pct": 3.05
    },
    {
      "group": "nightspire",
      "label": "nightspire",
      "claims": 259,
      "active_months": 10,
      "share_pct": 2.81
    },
    {
      "group": "clop",
      "label": "Clop",
      "claims": 237,
      "active_months": 9,
      "share_pct": 2.58
    },
    {
      "group": "play",
      "label": "play",
      "claims": 224,
      "active_months": 10,
      "share_pct": 2.43
    },
    {
      "group": "krybit",
      "label": "krybit",
      "claims": 167,
      "active_months": 7,
      "share_pct": 1.81
    },
    {
      "group": "safepay",
      "label": "safepay",
      "claims": 167,
      "active_months": 10,
      "share_pct": 1.81
    },
    {
      "group": "n0n",
      "label": "n0n",
      "claims": 163,
      "active_months": 2,
      "share_pct": 1.77
    },
    {
      "group": "everest",
      "label": "everest",
      "claims": 148,
      "active_months": 9,
      "share_pct": 1.61
    },
    {
      "group": "coinbasecartel",
      "label": "coinbasecartel",
      "claims": 145,
      "active_months": 8,
      "share_pct": 1.58
    },
    {
      "group": "shinyhunters",
      "label": "shinyhunters",
      "claims": 125,
      "active_months": 10,
      "share_pct": 1.36
    },
    {
      "group": "deadlock",
      "label": "deadlock",
      "claims": 111,
      "active_months": 4,
      "share_pct": 1.21
    },
    {
      "group": "silentransomgroup",
      "label": "silentransomgroup",
      "claims": 97,
      "active_months": 8,
      "share_pct": 1.05
    },
    {
      "group": "settra",
      "label": "settra",
      "claims": 94,
      "active_months": 5,
      "share_pct": 1.02
    },
    {
      "group": "genesis",
      "label": "genesis",
      "claims": 92,
      "active_months": 10,
      "share_pct": 1.0
    },
    {
      "group": "nova",
      "label": "Nova",
      "claims": 91,
      "active_months": 7,
      "share_pct": 0.99
    },
    {
      "group": "storm",
      "label": "storm",
      "claims": 89,
      "active_months": 3,
      "share_pct": 0.97
    },
    {
      "group": "sinobi",
      "label": "sinobi",
      "claims": 88,
      "active_months": 4,
      "share_pct": 0.96
    },
    {
      "group": "payload",
      "label": "payload",
      "claims": 84,
      "active_months": 9,
      "share_pct": 0.91
    },
    {
      "group": "apt73",
      "label": "apt73",
      "claims": 81,
      "active_months": 7,
      "share_pct": 0.88
    },
    {
      "group": "direwolf",
      "label": "direwolf",
      "claims": 81,
      "active_months": 5,
      "share_pct": 0.88
    },
    {
      "group": "auditteam",
      "label": "auditteam",
      "claims": 79,
      "active_months": 6,
      "share_pct": 0.86
    },
    {
      "group": "handala",
      "label": "handala",
      "claims": 78,
      "active_months": 4,
      "share_pct": 0.85
    },
    {
      "group": "payoutsking",
      "label": "payoutsking",
      "claims": 77,
      "active_months": 8,
      "share_pct": 0.84
    },
    {
      "group": "anubis",
      "label": "anubis",
      "claims": 74,
      "active_months": 10,
      "share_pct": 0.8
    },
    {
      "group": "pear",
      "label": "pear",
      "claims": 74,
      "active_months": 10,
      "share_pct": 0.8
    },
    {
      "group": "chaos",
      "label": "chaos",
      "claims": 64,
      "active_months": 10,
      "share_pct": 0.7
    },
    {
      "group": "worldleaks",
      "label": "worldleaks",
      "claims": 63,
      "active_months": 7,
      "share_pct": 0.68
    },
    {
      "group": "leakeddata",
      "label": "leakeddata",
      "claims": 61,
      "active_months": 3,
      "share_pct": 0.66
    },
    {
      "group": "orova",
      "label": "orova",
      "claims": 61,
      "active_months": 3,
      "share_pct": 0.66
    },
    {
      "group": "lynx",
      "label": "lynx",
      "claims": 60,
      "active_months": 7,
      "share_pct": 0.65
    },
    {
      "group": "ransomhouse",
      "label": "ransomhouse",
      "claims": 56,
      "active_months": 10,
      "share_pct": 0.61
    },
    {
      "group": "spacebears",
      "label": "spacebears",
      "claims": 56,
      "active_months": 9,
      "share_pct": 0.61
    },
    {
      "group": "lamashtu",
      "label": "lamashtu",
      "claims": 55,
      "active_months": 5,
      "share_pct": 0.6
    },
    {
      "group": "emperador",
      "label": "emperador",
      "claims": 54,
      "active_months": 3,
      "share_pct": 0.59
    },
    {
      "group": "interlock",
      "label": "interlock",
      "claims": 54,
      "active_months": 10,
      "share_pct": 0.59
    },
    {
      "group": "braincipher",
      "label": "braincipher",
      "claims": 53,
      "active_months": 9,
      "share_pct": 0.58
    },
    {
      "group": "aurora",
      "label": "aurora",
      "claims": 52,
      "active_months": 7,
      "share_pct": 0.57
    },
    {
      "group": "boobateam",
      "label": "boobateam",
      "claims": 52,
      "active_months": 4,
      "share_pct": 0.57
    },
    {
      "group": "insomnia",
      "label": "insomnia",
      "claims": 52,
      "active_months": 8,
      "share_pct": 0.57
    },
    {
      "group": "medusalocker",
      "label": "medusalocker",
      "claims": 52,
      "active_months": 5,
      "share_pct": 0.57
    },
    {
      "group": "ailock",
      "label": "ailock",
      "claims": 50,
      "active_months": 6,
      "share_pct": 0.54
    },
    {
      "group": "crpx0",
      "label": "CRPX0",
      "claims": 49,
      "active_months": 2,
      "share_pct": 0.53
    },
    {
      "group": "globalsecretgroup",
      "label": "globalsecretgroup",
      "claims": 48,
      "active_months": 4,
      "share_pct": 0.52
    },
    {
      "group": "rhysida",
      "label": "rhysida",
      "claims": 48,
      "active_months": 8,
      "share_pct": 0.52
    },
    {
      "group": "termite",
      "label": "termite",
      "claims": 46,
      "active_months": 9,
      "share_pct": 0.5
    },
    {
      "group": "panzer",
      "label": "panzer",
      "claims": 45,
      "active_months": 3,
      "share_pct": 0.49
    },
    {
      "group": "m3rx",
      "label": "m3rx",
      "claims": 42,
      "active_months": 6,
      "share_pct": 0.46
    },
    {
      "group": "tengu",
      "label": "tengu",
      "claims": 41,
      "active_months": 3,
      "share_pct": 0.45
    },
    {
      "group": "wallstreet",
      "label": "wallstreet",
      "claims": 41,
      "active_months": 4,
      "share_pct": 0.45
    },
    {
      "group": "cmdorganization",
      "label": "cmdorganization",
      "claims": 38,
      "active_months": 3,
      "share_pct": 0.41
    },
    {
      "group": "darkproject",
      "label": "darkproject",
      "claims": 36,
      "active_months": 3,
      "share_pct": 0.39
    },
    {
      "group": "stormous",
      "label": "stormous",
      "claims": 36,
      "active_months": 4,
      "share_pct": 0.39
    },
    {
      "group": "threeam",
      "label": "threeam",
      "claims": 36,
      "active_months": 6,
      "share_pct": 0.39
    },
    {
      "group": "bravox",
      "label": "bravox",
      "claims": 35,
      "active_months": 10,
      "share_pct": 0.38
    },
    {
      "group": "kairos",
      "label": "kairos",
      "claims": 35,
      "active_months": 9,
      "share_pct": 0.38
    },
    {
      "group": "gunra",
      "label": "gunra",
      "claims": 34,
      "active_months": 7,
      "share_pct": 0.37
    },
    {
      "group": "devman",
      "label": "devman",
      "claims": 33,
      "active_months": 2,
      "share_pct": 0.36
    },
    {
      "group": "majinahanashi",
      "label": "majinahanashi",
      "claims": 33,
      "active_months": 3,
      "share_pct": 0.36
    },
    {
      "group": "zawoo",
      "label": "zawoo",
      "claims": 32,
      "active_months": 2,
      "share_pct": 0.35
    },
    {
      "group": "blacknevas",
      "label": "blacknevas",
      "claims": 30,
      "active_months": 8,
      "share_pct": 0.33
    },
    {
      "group": "fulcrumsec",
      "label": "fulcrumsec",
      "claims": 29,
      "active_months": 4,
      "share_pct": 0.32
    },
    {
      "group": "lgroup",
      "label": "lgroup",
      "claims": 28,
      "active_months": 1,
      "share_pct": 0.3
    },
    {
      "group": "medusa",
      "label": "medusa",
      "claims": 28,
      "active_months": 4,
      "share_pct": 0.3
    },
    {
      "group": "orion",
      "label": "orion",
      "claims": 28,
      "active_months": 2,
      "share_pct": 0.3
    },
    {
      "group": "beast",
      "label": "beast",
      "claims": 27,
      "active_months": 7,
      "share_pct": 0.29
    },
    {
      "group": "metaencryptor",
      "label": "metaencryptor",
      "claims": 27,
      "active_months": 4,
      "share_pct": 0.29
    },
    {
      "group": "3am",
      "label": "3am",
      "claims": 26,
      "active_months": 5,
      "share_pct": 0.28
    },
    {
      "group": "shadowbyt3",
      "label": "shadowbyt3",
      "claims": 26,
      "active_months": 5,
      "share_pct": 0.28
    },
    {
      "group": "titan",
      "label": "titan",
      "claims": 26,
      "active_months": 4,
      "share_pct": 0.28
    },
    {
      "group": "killsec",
      "label": "killsec",
      "claims": 25,
      "active_months": 8,
      "share_pct": 0.27
    },
    {
      "group": "vect",
      "label": "Vect",
      "claims": 25,
      "active_months": 4,
      "share_pct": 0.27
    },
    {
      "group": "bavacai",
      "label": "bavacai",
      "claims": 23,
      "active_months": 2,
      "share_pct": 0.25
    },
    {
      "group": "lapsus",
      "label": "lapsus",
      "claims": 23,
      "active_months": 4,
      "share_pct": 0.25
    },
    {
      "group": "vexy",
      "label": "vexy",
      "claims": 23,
      "active_months": 2,
      "share_pct": 0.25
    },
    {
      "group": "eraleign",
      "label": "eraleign",
      "claims": 22,
      "active_months": 3,
      "share_pct": 0.24
    },
    {
      "group": "arcusmedia",
      "label": "arcusmedia",
      "claims": 20,
      "active_months": 4,
      "share_pct": 0.22
    },
    {
      "group": "eclipse",
      "label": "eclipse",
      "claims": 20,
      "active_months": 3,
      "share_pct": 0.22
    },
    {
      "group": "kazu",
      "label": "kazu",
      "claims": 20,
      "active_months": 3,
      "share_pct": 0.22
    },
    {
      "group": "blackx",
      "label": "blackx",
      "claims": 18,
      "active_months": 5,
      "share_pct": 0.2
    },
    {
      "group": "doommageddon",
      "label": "doommageddon",
      "claims": 18,
      "active_months": 4,
      "share_pct": 0.2
    },
    {
      "group": "alp001",
      "label": "alp001",
      "claims": 17,
      "active_months": 2,
      "share_pct": 0.18
    },
    {
      "group": "exfilsquad",
      "label": "exfilsquad",
      "claims": 17,
      "active_months": 1,
      "share_pct": 0.18
    },
    {
      "group": "helix",
      "label": "helix",
      "claims": 17,
      "active_months": 2,
      "share_pct": 0.18
    },
    {
      "group": "iah647",
      "label": "iah647",
      "claims": 16,
      "active_months": 3,
      "share_pct": 0.17
    },
    {
      "group": "barracuda",
      "label": "barracuda",
      "claims": 14,
      "active_months": 3,
      "share_pct": 0.15
    },
    {
      "group": "crypto24",
      "label": "crypto24",
      "claims": 14,
      "active_months": 6,
      "share_pct": 0.15
    },
    {
      "group": "hyflock",
      "label": "hyflock",
      "claims": 14,
      "active_months": 1,
      "share_pct": 0.15
    },
    {
      "group": "section9",
      "label": "section9",
      "claims": 14,
      "active_months": 1,
      "share_pct": 0.15
    },
    {
      "group": "securotop",
      "label": "securotop",
      "claims": 14,
      "active_months": 8,
      "share_pct": 0.15
    },
    {
      "group": "whitearmor",
      "label": "whitearmor",
      "claims": 14,
      "active_months": 1,
      "share_pct": 0.15
    },
    {
      "group": "imnotavillain",
      "label": "imnotavillain",
      "claims": 13,
      "active_months": 1,
      "share_pct": 0.14
    },
    {
      "group": "secp0",
      "label": "secp0",
      "claims": 13,
      "active_months": 3,
      "share_pct": 0.14
    },
    {
      "group": "unsafe",
      "label": "unsafe",
      "claims": 13,
      "active_months": 4,
      "share_pct": 0.14
    },
    {
      "group": "byod",
      "label": "byod",
      "claims": 12,
      "active_months": 1,
      "share_pct": 0.13
    },
    {
      "group": "cipherforce",
      "label": "cipherforce",
      "claims": 12,
      "active_months": 2,
      "share_pct": 0.13
    },
    {
      "group": "cyberleek",
      "label": "cyberleek",
      "claims": 12,
      "active_months": 1,
      "share_pct": 0.13
    },
    {
      "group": "dysphor1a",
      "label": "dysphor1a",
      "claims": 12,
      "active_months": 2,
      "share_pct": 0.13
    },
    {
      "group": "icarus",
      "label": "icarus",
      "claims": 12,
      "active_months": 2,
      "share_pct": 0.13
    },
    {
      "group": "morpheus",
      "label": "morpheus",
      "claims": 12,
      "active_months": 8,
      "share_pct": 0.13
    },
    {
      "group": "netrunner",
      "label": "netrunner",
      "claims": 12,
      "active_months": 3,
      "share_pct": 0.13
    },
    {
      "group": "nasirsecurity",
      "label": "nasirsecurity",
      "claims": 11,
      "active_months": 2,
      "share_pct": 0.12
    },
    {
      "group": "nitrogen",
      "label": "nitrogen",
      "claims": 11,
      "active_months": 6,
      "share_pct": 0.12
    },
    {
      "group": "cloak",
      "label": "cloak",
      "claims": 10,
      "active_months": 3,
      "share_pct": 0.11
    },
    {
      "group": "thesevendeadlysins",
      "label": "thesevendeadlysins",
      "claims": 10,
      "active_months": 1,
      "share_pct": 0.11
    },
    {
      "group": "umbra",
      "label": "umbra",
      "claims": 10,
      "active_months": 1,
      "share_pct": 0.11
    },
    {
      "group": "embargo",
      "label": "embargo",
      "claims": 9,
      "active_months": 3,
      "share_pct": 0.1
    },
    {
      "group": "leakbazaar",
      "label": "leakbazaar",
      "claims": 9,
      "active_months": 1,
      "share_pct": 0.1
    },
    {
      "group": "leaknet",
      "label": "leaknet",
      "claims": 9,
      "active_months": 3,
      "share_pct": 0.1
    },
    {
      "group": "sovcali",
      "label": "sovcali",
      "claims": 9,
      "active_months": 2,
      "share_pct": 0.1
    },
    {
      "group": "gammax",
      "label": "gammax",
      "claims": 8,
      "active_months": 3,
      "share_pct": 0.09
    },
    {
      "group": "moneymessage",
      "label": "moneymessage",
      "claims": 8,
      "active_months": 5,
      "share_pct": 0.09
    },
    {
      "group": "redact",
      "label": "redact",
      "claims": 8,
      "active_months": 2,
      "share_pct": 0.09
    },
    {
      "group": "xpl0itrs",
      "label": "xpl0itrs",
      "claims": 8,
      "active_months": 1,
      "share_pct": 0.09
    },
    {
      "group": "blackwater",
      "label": "blackwater",
      "claims": 7,
      "active_months": 4,
      "share_pct": 0.08
    },
    {
      "group": "endzone",
      "label": "endzone",
      "claims": 7,
      "active_months": 2,
      "share_pct": 0.08
    },
    {
      "group": "exitium",
      "label": "exitium",
      "claims": 7,
      "active_months": 4,
      "share_pct": 0.08
    },
    {
      "group": "global",
      "label": "global",
      "claims": 7,
      "active_months": 2,
      "share_pct": 0.08
    },
    {
      "group": "globalcyberneticcollective",
      "label": "globalcyberneticcollective",
      "claims": 7,
      "active_months": 1,
      "share_pct": 0.08
    },
    {
      "group": "prinzeugen",
      "label": "prinzeugen",
      "claims": 7,
      "active_months": 2,
      "share_pct": 0.08
    },
    {
      "group": "vypr",
      "label": "vypr",
      "claims": 7,
      "active_months": 1,
      "share_pct": 0.08
    },
    {
      "group": "abyss",
      "label": "abyss",
      "claims": 6,
      "active_months": 5,
      "share_pct": 0.07
    },
    {
      "group": "benzona",
      "label": "benzona",
      "claims": 6,
      "active_months": 1,
      "share_pct": 0.07
    },
    {
      "group": "blackshrantac",
      "label": "blackshrantac",
      "claims": 6,
      "active_months": 1,
      "share_pct": 0.07
    },
    {
      "group": "falcon",
      "label": "falcon",
      "claims": 6,
      "active_months": 2,
      "share_pct": 0.07
    },
    {
      "group": "obscura",
      "label": "obscura",
      "claims": 6,
      "active_months": 1,
      "share_pct": 0.07
    },
    {
      "group": "scarlettgroup",
      "label": "scarlettgroup",
      "claims": 6,
      "active_months": 1,
      "share_pct": 0.07
    },
    {
      "group": "thecrew",
      "label": "thecrew",
      "claims": 6,
      "active_months": 1,
      "share_pct": 0.07
    },
    {
      "group": "0daysyndicate",
      "label": "0daysyndicate",
      "claims": 5,
      "active_months": 1,
      "share_pct": 0.05
    },
    {
      "group": "cry0",
      "label": "cry0",
      "claims": 5,
      "active_months": 4,
      "share_pct": 0.05
    },
    {
      "group": "dataleak",
      "label": "dataleak",
      "claims": 5,
      "active_months": 1,
      "share_pct": 0.05
    },
    {
      "group": "linkc",
      "label": "linkc",
      "claims": 5,
      "active_months": 3,
      "share_pct": 0.05
    },
    {
      "group": "ms13089",
      "label": "ms13089",
      "claims": 5,
      "active_months": 3,
      "share_pct": 0.05
    },
    {
      "group": "sarcoma",
      "label": "sarcoma",
      "claims": 5,
      "active_months": 3,
      "share_pct": 0.05
    },
    {
      "group": "shiba",
      "label": "shiba",
      "claims": 5,
      "active_months": 2,
      "share_pct": 0.05
    },
    {
      "group": "spirals",
      "label": "spirals",
      "claims": 5,
      "active_months": 2,
      "share_pct": 0.05
    },
    {
      "group": "tridentlocker",
      "label": "tridentlocker",
      "claims": 5,
      "active_months": 5,
      "share_pct": 0.05
    },
    {
      "group": "blackout",
      "label": "blackout",
      "claims": 4,
      "active_months": 2,
      "share_pct": 0.04
    },
    {
      "group": "triplex",
      "label": "triplex",
      "claims": 4,
      "active_months": 4,
      "share_pct": 0.04
    },
    {
      "group": "abyssdata",
      "label": "abyssdata",
      "claims": 3,
      "active_months": 2,
      "share_pct": 0.03
    },
    {
      "group": "blacklocks",
      "label": "blacklocks",
      "claims": 3,
      "active_months": 1,
      "share_pct": 0.03
    },
    {
      "group": "d1r",
      "label": "d1r",
      "claims": 3,
      "active_months": 1,
      "share_pct": 0.03
    },
    {
      "group": "ethics",
      "label": "ethics",
      "claims": 3,
      "active_months": 1,
      "share_pct": 0.03
    },
    {
      "group": "kittykatkrew",
      "label": "kittykatkrew",
      "claims": 3,
      "active_months": 1,
      "share_pct": 0.03
    },
    {
      "group": "ransomexx",
      "label": "ransomexx",
      "claims": 3,
      "active_months": 2,
      "share_pct": 0.03
    },
    {
      "group": "timc",
      "label": "timc",
      "claims": 3,
      "active_months": 1,
      "share_pct": 0.03
    },
    {
      "group": "ulose",
      "label": "ulose",
      "claims": 3,
      "active_months": 2,
      "share_pct": 0.03
    },
    {
      "group": "blackbytecrux",
      "label": "blackbytecrux",
      "claims": 2,
      "active_months": 1,
      "share_pct": 0.02
    },
    {
      "group": "bluewhale",
      "label": "bluewhale",
      "claims": 2,
      "active_months": 1,
      "share_pct": 0.02
    },
    {
      "group": "ciphbit",
      "label": "ciphbit",
      "claims": 2,
      "active_months": 1,
      "share_pct": 0.02
    },
    {
      "group": "meowciety403",
      "label": "meowciety403",
      "claims": 2,
      "active_months": 2,
      "share_pct": 0.02
    },
    {
      "group": "mimori",
      "label": "mimori",
      "claims": 2,
      "active_months": 1,
      "share_pct": 0.02
    },
    {
      "group": "mnt6",
      "label": "mnt6",
      "claims": 2,
      "active_months": 1,
      "share_pct": 0.02
    },
    {
      "group": "osiris",
      "label": "osiris",
      "claims": 2,
      "active_months": 2,
      "share_pct": 0.02
    },
    {
      "group": "thegreenbloodgroup",
      "label": "thegreenbloodgroup",
      "claims": 2,
      "active_months": 1,
      "share_pct": 0.02
    },
    {
      "group": "0x00",
      "label": "0x00",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "alphalocker",
      "label": "alphalocker",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "atomsilo",
      "label": "atomsilo",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "blackfield",
      "label": "blackfield",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "brotherhood",
      "label": "brotherhood",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "dreamfyre",
      "label": "dreamfyre",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "kyber",
      "label": "kyber",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "loki",
      "label": "loki",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "mydata",
      "label": "mydata",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "orca",
      "label": "orca",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "radar",
      "label": "radar",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "reynolds",
      "label": "reynolds",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "runsomewares",
      "label": "runsomewares",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "sicarii",
      "label": "sicarii",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "spycorporate",
      "label": "spycorporate",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "syndicate",
      "label": "syndicate",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "toufan",
      "label": "toufan",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    },
    {
      "group": "xp95",
      "label": "xp95",
      "claims": 1,
      "active_months": 1,
      "share_pct": 0.01
    }
  ],
  "limitations": [
    "A claim is one canonical group–victim pair in the collected relay posts, not a confirmed breach or a count of unique organizations.",
    "The observation window is 1 January–27 October 2026 (UTC). October is partial; 22–28 July is sampled. The series is not a complete census of worldwide ransomware.",
    "Multiple relay channels may copy the same upstream source. Repeated relay posts are not independent confirmation of an attack.",
    "Counts exclude 190 claims attributed to 0APT; spelling variants are merged before selecting the first observation, removing 171 duplicate pairs.",
    "The edited catalogue contains 60 retained items, including 12 recruitment items. It is a selected inventory, not a prevalence estimate or an independently replayed retrieval count.",
    "Advertised prices, revenue shares and service capabilities are seller claims. They do not demonstrate a completed sale, an effective tool or a payment to an affiliate.",
    "Recruitment items mix nine programme descriptions, two partner notices and an insider signature. Different negotiation responsibilities are not one support-service measure.",
    "No reliable sector distribution is published because sector tags did not pass quality checks. Recruitment timing does not establish that an ad caused later claims.",
    "A public advisory date and a relayed claim date do not establish the same incident without an event-level join. No warning interval is derived from unjoined dates.",
    "This package omits victim names, contact handles, illicit service links and raw post identifiers. Publication of an aggregate does not validate the underlying allegation."
  ],
  "findings": [
    {
      "id": "concentration",
      "title": "A small persistent core accounts for most claims.",
      "text": "33 groups with claims in at least eight observed months account for 5,950 of 9,203 claims (64.7%).",
      "evidence": "Canonical group–victim pairs, 1 Jan–27 Oct 2026.",
      "limit": "Persistence means observed activity across months, not continuous operations or organizational identity."
    },
    {
      "id": "leaders",
      "title": "Two names account for almost one in four claims.",
      "text": "Qilin (1,146) and The Gentlemen (1,012) together account for 2,158 claims, or 23.4% of the collected total.",
      "evidence": "Canonical group totals.",
      "limit": "This is concentration in this dataset, not a worldwide market share."
    },
    {
      "id": "monthly",
      "title": "August is the largest observed month.",
      "text": "The collected series records 1,321 claims in August, compared with 761–963 per month from January through July.",
      "evidence": "First UTC observation of each canonical pair.",
      "limit": "22–28 July is sampled. October has 1,089 claims only through 27 October; no full-month projection is made."
    },
    {
      "id": "negotiation",
      "title": "Negotiation is part of the advertised service.",
      "text": "Programme ads describe different support roles. One advertises a hosted portal at $100 setup plus $30 per month.",
      "evidence": "Selected programme descriptions; portal offer dated 1 Jun 2026.",
      "limit": "Support includes forwarding victim contact for affiliate-run talks. Offers do not establish delivered services or completed sales."
    },
    {
      "id": "splits",
      "title": "Recruitment offers advertise shares as high as 95%.",
      "text": "Six programme ads state or imply a partner share, ranging from 70% to 95%; three advertise a fixed 90%.",
      "evidence": "Reviewed catalogue and reconciled recruitment terms.",
      "limit": "Nova’s 95% is conditional on a revenue threshold with no currency stated. Shares advertised are not payments observed."
    },
    {
      "id": "relays",
      "title": "Repeated visibility is not independent confirmation.",
      "text": "7,862 claims (85.4%) appear through more than one relay in the collected data.",
      "evidence": "Relay identities unioned across aliases for each canonical pair.",
      "limit": "Relays may share an upstream source; this measures distribution, not validation."
    }
  ],
  "assets": {
    "pdf": "ransomware-report-2026.pdf",
    "monthly_csv": "monthly-claims.csv",
    "groups_csv": "group-claims.csv",
    "group_monthly_csv": "group-monthly-claims.csv",
    "splits_csv": "advertised-splits.csv",
    "prices_csv": "advertised-prices.csv",
    "monthly_recruitment_csv": "monthly-claims-and-recruitment.csv",
    "manifest": "ransomware-data.json",
    "methodology": "methodology.html",
    "dictionary": "data-dictionary.html",
    "press": "press-kit.html",
    "license": "license.html",
    "charts": [
      {
        "id": "monthly",
        "title": "Monthly claims in the collected dataset",
        "svg": "chart-monthly.svg",
        "png": "chart-monthly.png",
        "alt": "Monthly canonical claims: Jan 784, Feb 793, Mar 963, Apr 844, May 761, Jun 820, Jul 874, Aug 1,321, Sep 954, Oct 1,089. July 22–28 sampled; October through day 27."
      },
      {
        "id": "concentration",
        "title": "A persistent core drives most observed claims",
        "svg": "chart-concentration.svg",
        "png": "chart-concentration.png",
        "alt": "33 of 177 groups with activity in at least eight months account for 5,950 of 9,203 claims, or 64.7%. Qilin and The Gentlemen together account for 23.4%."
      },
      {
        "id": "services",
        "title": "Four advertised components of the ransomware economy",
        "svg": "chart-services.svg",
        "png": "chart-services.png",
        "alt": "Selected offers: builder $50 on 29 Apr; negotiation portal $100 setup plus $30 monthly on 1 Jun; EDR-killer tool $550 on 18 Aug; white-label platform $5,000 on 23 Jul. Asking prices as advertised, with no currency named; not sales or market minima."
      },
      {
        "id": "recruitment",
        "title": "What the reviewed recruitment sample says",
        "svg": "chart-recruitment.svg",
        "png": "chart-recruitment.png",
        "alt": "12 recruitment items: nine programme ads, two partner notices and one insider offer. Support roles differ by offer; six programme ads state or imply a split, ranging from 70% to 95%."
      },
      {
        "id": "january-cohort",
        "title": "January's leaders represented less of September",
        "svg": "chart-january-cohort.svg",
        "png": "chart-january-cohort.png",
        "alt": "Fixed January top-ten labels: 67.2% of January claims and 29.1% of September claims. In-month leaders are selected retrospectively. July 22–28 collection sampled; October excluded as partial."
      }
    ],
    "social": {
      "overview": "social-overview.png",
      "claims": "social-claims.png",
      "services": "social-services.png"
    },
    "article_charts": [
      {
        "id": 1,
        "svg": "chart-article-1.svg",
        "csv": "advertised-splits.csv"
      },
      {
        "id": 2,
        "svg": "chart-article-2.svg",
        "csv": "advertised-prices.csv"
      },
      {
        "id": 3,
        "svg": "chart-article-3.svg",
        "csv": "monthly-claims-and-recruitment.csv"
      },
      {
        "id": 4,
        "svg": "chart-article-4.svg",
        "csv": "group-monthly-claims.csv"
      }
    ],
    "january_cohort_csv": "january-cohort-coverage.csv",
    "january_cohort_sensitivity_csv": "january-cohort-sensitivity.csv",
    "january_cohort_method": "january-cohort-method.html",
    "january_cohort_reproduction": "reproduce-january-cohort.py"
  },
  "license": "CC BY 4.0 for original aggregate data and charts; see license.html",
  "attribution": "Source: Brandefense Research Team, Inside the Ransomware Economy, 2026, v1.3. Data: Brandefense Blackhole, 1 Jan–27 Oct 2026. Claims, not confirmed breaches.",
  "ai_disclosure": "Brandefense Research Team · Brandefense Blackhole data · Prepared by Claude Opus 5.5, checked by Codex Astra and approved by Brandefense analysts. Why AI agents. Brandefense Blackhole, our cybercrime database, collects around 17 to 23 million dark web and Telegram posts a month. Reading that volume by hand, and linking a recruitment ad on one forum to a leak-site claim on another and a price list in a Telegram channel weeks later, is beyond what a human team can do alone. Claude Opus 5.5 prepared the research: it searched the data, sorted and translated posts and drafted the text. Codex Astra then checked every number against the dataset files and tested each claim, and anything that did not hold was removed. Brandefense analysts reviewed and approved the findings."
}