The world's top ransomware gangs have created a cybercrime "cartel"

Several of the largest Russian ransomware cybercriminal gangs have partnered up and are sharing hacking techniques, purloined data-breach information, malware code and technology infrastructure.

The most active collaborators are four groups known as Wizard Spider, Twisted Spider, Viking Spider and LockBit. The gangs in this cluster jointly control access to illicit data leak sites and custom ransomware code. They also associate with the larger criminal ransomware ecosystem, exert influence over smaller gangs and license their tools to affiliates, said Jon DiMaggio, chief security strategist at Analyst1. The groups do not appear to share profits from criminal activity. "They're not a cartel in the traditional sense, like oil companies that have a lock on the supply of crude," DiMaggio explained. "But they do have technology infrastructure, and some are big enough to have their own [ransomware] code. These are limited resources."