Alliances between ransomware groups tied to recent surge in cybercrime

Ransomware activity surged 41% month-on-month from September to October, with NCC Group recording 594 attacks in October and Qilin responsible for 170 incidents (29%). Industrials were the most targeted sector (167 attacks, 28%), followed by consumer discretionary (124) and healthcare (64); North America accounted for 62% of attacks. The spike is attributed to new entrants and alliances (notably LockBit 5.0 aligning with DragonForce and Qilin), lowering technical barriers and tactical shifts (file-less operations, single‑extortion), raising operational and cyber‑insurance risk for exposed sectors while increasing potential demand for cybersecurity vendors.

Analysis

Market structure: The October 41% month-on-month surge and concentration (Qilin 29%) signal rising demand for enterprise security products and services—expect 10–20% revenue tailwinds for leading EDR/NDR vendors over the next 6–12 months as corporate budgets are reallocated. Industrials, consumer discretionary and healthcare are immediate loss-making sectors (28%, 21%, 11% of attacks); expect higher cyber insurance premiums and longer sales cycles for these verticals, pressuring margins for exposed mid-cap players.

Risk assessment: Tail risks include a systemic breach of a Top-10 retailer or major healthcare provider (low probability, high impact) that could force regulatory bans on ransom payments or a crypto-liquidity shock; either would materially change attacker economics and vendor demand. Near-term (days–weeks) volatility will spike into Black Friday/Cyber Monday; medium-term (3–12 months) expect capex-driven revenue growth for security vendors but margin pressure for customers and insurers; long-term (12–36 months) consolidation among RaaS and vendors is likely.

Trade implications: Favor large-cap cybersecurity incumbents and diversified cyber ETFs while hedging consumer discretionary retail exposure. Use directional options to express conviction (3-month call spreads on PANW/CRWD) and buy 1–3 month puts on retail ETF XRT ahead of peak shopping season; size initial long positions 1–3% of portfolio with stop-loss thresholds (10–15%).

Contrarian angles: Consensus underestimates that law-enforcement takedowns or fragmentation could temporarily reduce attack volumes and compress near-term security spend—this would be a catalyst to pause aggressive buys if quarterly attack metrics fall >25% month-on-month. Conversely, the market may underprice structural increases in cyber insurance pricing and long-term vendor RPO; historical spikes (2017–2018) led to multi-quarter outperformance for incumbents, suggesting patience on 6–12 month horizons.

Key Decisions for Investors

• Establish a 2–3% long position split between CRWD and PANW (≈1–1.5% each) within 1–4 weeks, target 15–25% upside over 6–12 months; trim to 1% if no material breach-driven catalyst by March 31, 2026.
• Buy HACK ETF (Global X Cybersecurity) to overweight cybersecurity by +2% vs. benchmark; hold 6–12 months and take profits on a 20%+ move or sooner if quarterly attack metrics decelerate >25% MoM.
• Implement a pair trade: long CRWD (1.5%) / short XRT (1.5%) to capture rotation from vulnerable retail to security vendors; hedge the short with 1–3 month 10–15% OTM puts on XRT sized to the short position.
• Use options: purchase 3-month call spreads on PANW or CRWD (buy ATM, sell 20% OTM) sized at 0.5–1% notional to lever upside while capping premium; and buy 1–3 month puts on XRT as downside insurance into Black Friday/Cyber Monday.
• Reduce small/mid-cap consumer discretionary exposure by 3–5% over the next 30 days (favor names with >30% holiday revenue and weak balance sheets) and reallocate proceeds to cybersecurity/defense names and HACK ETF.