After the Successors: Affiliate Collapse, Social-Engineering Mega-Hits, and Resilience Lessons from the 2025 Ransomware Ecosystem

Abstract

Background: The 2025 ransomware year put to its first test the ecosystem-churn model that the 2024 disruption record — Operation Cronos, the ALPHV exit scam, and the documented rise of successor brands — had suggested [3]. RansomHub — the successor brand that had absorbed LockBit's displaced affiliates — went dark on 1 April 2025, with its affiliate pool publicly claimed by the DragonForce "cartel" model within a day. The year's most consequential incidents were not encryption feats but social-engineering campaigns: the April 2025 attacks on Marks & Spencer (reported ~£300 million in lost profits; online orders halted for weeks) and the Co-operative Group (£206 million in lost first-half revenue, £80 million in operating-profit impact), both attributed to the Scattered Spider collective using help-desk and identity social engineering on the DragonForce platform. Meanwhile, on-chain ransomware payments fell roughly 35% year-over-year to approximately $813.55 million in 2024 (Chainalysis), even as single-incident impact reached record levels. Objective: We analyze the 2025 record as a test of the displacement-versus-dismantlement thesis and extract the resilience lessons that follow. Methods: Event-driven qualitative analysis of the 2025 record from primary disclosures, corporate statements, and law-enforcement reporting; payment-flow analysis from blockchain analytics; and a stage-versus-control coverage assessment. Results: The churn model performed: brand-level collapse produced affiliate migration, not dismantlement. Impact decoupled from payment volume: the signature 2025 incidents were human-vector attacks whose costs were driven by operational halt, third-party access compromise, and recovery duration — not by encryption sophistication. Disclosure worked: the year's impact figures became public within months, in the disclosure era the field entered in 2024. Conclusions: Resilience investment belongs at the identity and help-desk boundary, in third-party access governance, and in tested recovery — with disclosure-era accountability as the forcing function.