# Why do ransomware groups change their names?

Mostly to escape pressure. A well-known name attracts law enforcement, sanctions and blocklists, and many insurers and companies refuse to pay groups under sanctions, so a new name can make payment easier for the criminals. A rebrand can also follow an internal split, a leak of the group's chats or a police operation. Official sources document several such changes: CISA's August 2024 update of its advisory on Royal states that BlackSuit is a rebrand of Royal, and its August 2024 advisory on RansomHub notes that the operation was formerly known as Cyclops and Knight. After the leak of Conti's internal chats in 2022, its members dispersed into other operations. For defenders the lesson is simple: the name on the ransom note changes faster than the techniques behind it. Track the techniques, which each advisory lists with MITRE ATT&CK references, not only the brand names.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/why-do-ransomware-groups-rebrand

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [How should a small company use a ransomware advisory?](https://netsenx.com/en/faq/how-a-small-company-should-use-a-ransomware-advisory)
- [What is LockBit ransomware?](https://netsenx.com/en/faq/what-is-lockbit-ransomware)
- [What is ALPHV, also called BlackCat?](https://netsenx.com/en/faq/what-is-alphv-blackcat-ransomware)
- [What is Black Basta ransomware?](https://netsenx.com/en/faq/what-is-black-basta-ransomware)
- [What is Akira ransomware?](https://netsenx.com/en/faq/what-is-akira-ransomware)