RansomHub Shutdown Sparks Cyber Turf War with Qilin and DragonForce

RansomHub Shutdown Sparks Cyber Turf War with Qilin and DragonForce

Summary:

• RansomHub’s sudden shutdown on April 1 left its affiliates looking for a new home.
• The Qilin ransomware operation picked up many of those affiliates.
• DragonForce claimed RansomHub was moving onto its new “cartel” platform and kept up attacks on rival groups.
• More competition among gangs means more pressure on victims.
• Defenders are urged to tighten basic controls and share threat data.

The abrupt fall of RansomHub

RansomHub, one of the most active ransomware-as-a-service (RaaS) operations of 2024, went offline without warning on April 1, 2025. Its leak site went dark and affiliates lost access to their panels. They had relied on the group’s software and infrastructure to run attacks, and suddenly they needed somewhere else to go.

The Rise of Qilin

Qilin was one of the main winners. Researchers saw its leak-site postings climb in April as former RansomHub affiliates moved over. Qilin offers affiliates encryptors for Windows, Linux and VMware ESXi along with a negotiation panel, and it pays them a large cut of each ransom. Those are the things affiliates shop for.

DragonForce Moves In

DragonForce took a louder approach. Days after RansomHub went down, it claimed on underground forums that RansomHub was moving to its new “cartel” platform, which lets affiliates run their own brands on DragonForce infrastructure. The group had already defaced the leak sites of smaller rivals. Its affiliates were later linked to the April attacks on British retailers, including Marks & Spencer. Researchers say this kind of infighting can make attacks less predictable for victims.

What It Means for Defenders

The shakeup does not change how most ransomware attacks start. Affiliates still break in through stolen credentials, unpatched VPNs and remote-access tools. That means the basics still matter most. Patch internet-facing systems quickly. Require multi-factor authentication. Keep offline backups and test restoring them.

The Case for Working Together

Ransomware crews move across borders and between brands, so no single company or country can track them alone. Sharing indicators through industry groups and government agencies helps defenders spot an affiliate who simply changed logos.

Where This Leaves Things

RansomHub’s disappearance reshuffled the ransomware market rather than shrinking it. Qilin gained affiliates. DragonForce pushed its cartel model and kept fighting rivals. For victims, the names on the ransom note changed. The playbook did not.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.