For years, security teams kept a mental roster of ransomware villains: LockBit is the aggressive one, Conti was the professional one, Evil Corp is the sanctioned one. Pick a name, check your logs, respond accordingly. New research from DomainTools, Analyst1, and Scylla Intel suggests that whole approach is built on a fiction. The gangs we treat as separate companies are actually sharing code, servers, and even staff. They are less a lineup of competitors and more one sprawling, messy marketplace. That's not a metaphor. It's what the data shows.
The Map That Exposed the Mess
The researchers built what they call "A Visual and Analytical Map of Russian-Affiliated Ransomware Groups," and the title undersells it. Starting from well-known names like Conti, LockBit, and Evil Corp, they spidered outward through open-source intelligence, historical infrastructure data, and human sources. What they found were overlaps everywhere: identical IP addresses, matching passive DNS records, shared SSL certificates, and the same bulletproof hosting providers propping up multiple crews.
It got harder to say where one group ended and another began. That's partly a hangover from the Conti takedown in mid-2024, which scattered its affiliates across the underground. Those operators didn't disappear. They re-registered under fresh banners, carrying their playbooks and contacts with them. Rebranding, the report notes, is a feature, not a bug. Evil Corp, sanctioned by the US Treasury, has kept operating by renaming itself repeatedly while reusing the same infrastructure, proof that names change faster than capabilities do.
Code That Gets Around
The code sharing is the part that should worry anyone relying on signature-based detection. Analysts comparing the loader stages of Black Basta and QakBot found nearly identical decryptor routines, differing mainly in offset values. Same encryption logic, different wrapper. When malware families share that kind of DNA, antivirus signatures tuned for one strain can miss the twin wearing another name.
There's also the tooling angle. The research flagged heavy use of legitimate remote access tools like AnyDesk and Quick Assist across operations, a sign of shared training, shared playbooks, or outright crossover between teams. Your defenders aren't fighting a brand. They're fighting a pool of reusable parts that any crew can grab.
People Jump Ship, Brands Stay
The most human finding is also the most damning for ransomware attribution. Operators drift between groups like employees switching startups. Take the actor known as Wazawaka, whom the FBI has linked to REvil, Babuk, LockBit, Hive, and Conti across his career. Or Bassterlord, who moved from REvil to Avaddon, then LockBit, and finally Hive. These are not isolated cases; they're the pattern.
That mobility explains why takedowns feel like whack-a-mole. When law enforcement dismantles one operation, the people don't retire. They walk to the next shop with their skills intact, and the infrastructure gets recycled. The researchers put it bluntly: reuse does not equal identity, and group labeling is increasingly obsolete.
What This Means for Defenders
The practical takeaway is uncomfortable but useful. Stop anchoring threat hunting to family names and start tracking clusters of activity: shared infrastructure, code fragments, and behavioral patterns that outlive any single brand. A certificate fingerprint or a passive DNS record can be a more stable warning sign than the latest ransom note's branding.
For a security team, that means investing in cyber threat intelligence that maps infrastructure and human networks, not just malware signatures. It means watching for the same tools and techniques showing up across incidents that look unrelated on the surface. The enemy isn't a roster of gangs. It's an ecosystem, and the sooner detection strategies treat it that way, the harder it becomes for attackers to simply change their name and start again.