VERY IMPORTANT

The shutdown of the Leafroller ransomware gang (aka Sodinokibi/REvil) has resulted in a surge in LockBit activity, as some ex-Sodinokibi affiliates move to that ransomware. Meanwhile, there is also more evidence that some attackers are affiliated to more than one ransomware group and are switching between ransomware families mid-attack if the initial ransomware they attempt to deploy fails to execute.