From Oligopoly to Fragmentation: Market Structure and Law-Enforcement Disruption in the Ransomware-as-a-Service Economy

Abstract Cybercrime-as-a-Service (CaaS) is widely described as an industrialised market, yet the structure of that market is rarely measured. We study Ransomware-as-a-Service (RaaS) as an industry, using 29,162 victim claims published by 287 groups on data leak sites between January 2022 and September 2026. We combine a model of the CaaS supply chain, a mapping of ransomware and phishing services onto MITRE ATT&CK, and measures from industrial organisation and survival analysis. The market moved from a tight oligopoly to a fragmented one. The quarterly Herfindahl–Hirschman Index fell from 2,000–2,350 in early 2022, when LockBit alone posted up to 46% of claims, to 440–730 from 2024 onwards, about 28% less each year. The decline holds when known rebrands are merged into one organisation, when reposts, small groups or mass-exploitation campaigns are excluded, and in a second leak-site tracker. Brands are short-lived: the median brand stops posting after about nine months. After Operation Cronos in February 2024, LockBit's share fell from 20.7% to 1.0% within a year. Across seven law-enforcement operations against ransomware groups between 2023 and 2025, we find no detectable fall in market-wide claims, and the share lost by targeted groups was redistributed in the same way as in ordinary months. Disruption reshapes the market rather than shrinking it. We discuss implications for law enforcement, defenders and EU policy.