Bitdefender's June threat debrief flags a structural shift in the ransomware market: affiliates are now claiming victims already posted by rival crews 1. Affiliates are the independent operators who lease attack tooling from a ransomware-as-a-service brand and split the proceeds. The cross-claiming is a symptom of how freely they now move between programmes, and of how commoditised the IAB (initial access broker) market has become. The same brokered, pre-authenticated access that a Check Point VPN zero-day supplies in bulk a few sections up feeds this churn directly.
The Silent Ransomware Group has added physical on-site infiltration against legal and financial firms, pairing a network intrusion with a person through the door. MedusaLocker has rebranded as Bavacai and re-entered the top ten, a familiar move that lets a crew shed law-enforcement heat without losing its tooling 2.
Construction has overtaken manufacturing as the most-targeted sector 3. The logic is unglamorous: construction firms combine project-stage cash-flow pressure with weaker security maturity than manufacturing, which makes them quicker to pay and slower to detect. Enforcement is working the same market from the other end. The Europol seizure that disrupted at least 25 gangs helped push two crews out of the top tier after law-enforcement visibility rose, set against May's baseline of 95 disclosed victims across 37 active groups . The picture is a market under pressure but not consolidating: crews rebrand and re-enter faster than takedowns remove them.
