Ransomware brands are arriving twice as fast. They are not dying any faster.

Every account of the ransomware ecosystem tells the same story: the brands are disposable. A group appears, runs for a while, gets disrupted or burns its reputation, and comes back under a new name. Attached to that story is usually a second claim — that the churn is accelerating, that brands today burn out faster than they used to.

The first half is true. The second half, in our data, is not.

What we counted

Every claim a ransomware group has published on its own leak site since January 2020: 33,568 claims across 323 distinct brands, current through 28 August 2026.

For anything about lifespan we use the 268 brands with at least five claims. The cut matters: 56 of the 323 posted on a single day and never again. Whether those are real brands, test posts, or scraping artifacts, including them drags the median lifespan from 184 days down to 99 — the number moves more than any finding in this piece. So we say which population we mean, every time.

Brand formation has roughly doubled

New ransomware brands, by year of first claim
Brands with 5+ claims
268 brands
202139
202232
202334
202444
202570
202646 · 8 months

From 2021 to 2023 the ecosystem produced a steady 35 new brands a year. In 2025 it produced 70. Through the first eight months of 2026 it has produced 46 — on the same pace.

That part matches the story everyone tells. More names, more leak sites, more logos.

But survival did not fall

Here is where it comes apart. If brands were burning out faster, each successive cohort should be less likely to reach its six-month mark. Instead:

Share of each cohort still claiming victims 180 days after its first claim
By year of first claim
percent
202146%
202259%
202362%
202470%
202554%

Six-month survival rose from 46% for the 2021 cohort to 70% for 2024. One-year survival moved the same way: 33% → 59%. The 2025 cohort then fell back to 54% at six months and 36% at one year.

So the honest summary is not "brands die faster." It is: the ecosystem got wider, and the brands that enter it are, if anything, more durable than the 2021 vintage. The 2025 dip is one cohort. It is worth watching. It is not yet a trend.

The measurement that would have fooled us

Our own design notes for this piece proposed a different chart: median lifespan by year of first claim. It produces a clean, dramatic decline — 2023 brands last a median 594 days, 2025 brands 196, 2026 brands 49.

That chart is worthless, and it is worth explaining why, because it is the most natural chart to draw.

A brand's measured lifespan is the gap between its first and last claim. A brand that first appeared in June 2026 has had at most about ninety days in which to accumulate one. Its short measured life says nothing about its durability and everything about the fact that we are looking at it early. Statisticians call this right-censoring, and it guarantees that recent cohorts look short-lived no matter what is actually happening.

The survival measure above avoids it: we ask only whether a brand was still claiming victims 180 days after it started, and we ask that only of brands that first appeared at least 180 days ago. Every cohort in that chart has had the same amount of time to fail.

We are showing our discarded chart rather than quietly not showing it, because "median lifespan is falling" is exactly the kind of finding that gets screenshotted.

What we cannot see

A claim is not a confirmed breach. Every figure here is built on what groups published about themselves. Groups inflate, repost, and occasionally fabricate — including, in one case in our data, fabricating victim entries containing attacks aimed at the tools that scrape them.

A brand is not a group. When operators retire a name and start another, we see two brands. Some of what looks like new formation is the same people with a new logo, and nothing in leak-site data distinguishes the two. The doubling is real as a count of names; whether the number of operators doubled is a question this data cannot answer.

Silence is not death. 155 of the 268 brands have posted nothing in over 180 days. We call that dormant, not gone — a leak site can go quiet during a rebuild and come back.

Method

Claims come from RansomLook leak-site mirroring, deduplicated by (group, victim, month) and never pruned. Population: brands with 5+ claims. Survival: a brand "survived 180 days" if the gap between its first and last claim is at least 180 days; only brands whose first claim is at least 180 days old are eligible. Data through 28 August 2026. The underlying records are browsable at Threat Actors.