Ransomware gangs, mercs, and cartels: the new powers threatening global security

By John Fernando Muñoz | 2026-06-09

A devastating ransomware attack on June 3, 2024, against pathology services company Synnovis in London forced seven of the city’s major hospitals to cancel more than 800 surgeries and hundreds of appointments over the course of a week.

A criminal network operating from somewhere beyond the reach of any single jurisdiction had paralyzed part of the United Kingdom's national health system.

This is only one example of the type of emerging new powers threatening global security.

Non-state actors

The ability to project force, destabilize entire societies, and control vast territories is no longer the exclusive domain of nation-states.

Just as cybercriminals can shut down hospitals, mercenary companies can wage wars on behalf of governments too weak or too cautious to commit their own troops.

Transnational gangs and criminal organizations can govern entire neighborhoods in major cities through extortion, violence, and fear. They collect parallel "taxes" from businesses and communities that the state has failed to protect, a sign that many people are living in an era where non-state actors are already operating with near-total freedom of movement.

The term "non-state actors" is a broad category covering a wide range of very different organizations: Russia-linked mercenaries deployed across Africa, ransomware gangs operating out of Eastern Europe, hacktivist collectives capable of mobilizing thousands of volunteers with a single social media post, and transnational networks that traffic drugs, weapons, migrants, and money across continents.

These groups share no common ideology or method. What they have in common is that they exercise real power while operating outside formal state authority, and often beyond the reach of the international legal frameworks built to regulate behavior between states.

The Office of the Director of National Intelligence noted in March, in its 2026 Annual Threat Assessment, that cyberspace has become the primary arena of conflict, one in which both state and non-state actors are actively targeting critical infrastructure.

That assessment also reflects a broader consensus among intelligence evaluations and security analysts, who point out that weakening institutions, contested geopolitics, low-cost technology, and global finance have all contributed to lowering the barrier to entry for groups seeking to project power without a flag.

Between January and September 2025 alone, researchers documented nearly 4,700 confirmed ransomware incidents worldwide, representing a 34 percent increase over the same period in 2024. Half of those attacks struck critical infrastructure sectors including manufacturing, healthcare, energy, transportation, and finance.

The FBI calculated a record $16.6 billion in cybercrime losses in 2024, a 33 percent jump compared to the previous year.

The groups behind these attacks increasingly resemble corporations more than criminal gangs. They offer ransomware-as-a-service platforms, where affiliates pay a fee to use established malware and infrastructure in exchange for a cut of the ransom. They even run customer service operations, accept installment payments, and issue press releases when they breach high-profile targets.

Some 103 active ransomware groups were tracked in 2025, but just five of them (Qilin, Clop, Akira, Play, and SafePay) were responsible for nearly a quarter of all incidents, reflecting a growing professionalization and consolidation within the cybercriminal economy.

Beyond ransomware, there is another category of digital services known as hack-for-hire firms, which sell surveillance tools, espionage capabilities, and disruption services to governments, corporations, and political clients, to anyone with a budget.

Guns for Hire

Similar patterns play out on the physical battlefield. Russian, Chinese, and other private military companies now operate on every continent, performing functions that once belonged exclusively to states, protecting critical infrastructure, providing direct combat support to regular troops, gathering intelligence, and training security sector recruits.

The clearest and most consequential example is the Wagner Group and its successor, Africa Corps. These Russian private military companies, operating under Kremlin direction, were deployed in combat roles in Libya, Syria, Ukraine, and across sub-Saharan Africa.

In Mali alone, more than 450 civilians lost their lives in nine incidents linked to Wagner between 2020 and 2022.

Moscow used Wagner's ambiguous legal status as a private company to conceal military setbacks and contractor deaths, rebranding failures as Wagner's problem, not Russia's.

Western private military companies also remain active, particularly in counter-terrorism roles across Africa. What sets them apart is that they almost universally stop short of direct combat. Russian and Chinese contractors, by contrast, engage directly in military operations, and their payment often takes the form of access to natural resources and mining concessions in the areas where they operate.

The Criminal State

Transnational criminal networks represent one of the most complex challenges of all, because their power is not only coercive, it is economic and social. Gangs like MS-13 collect what they call la renta: a systematic tax levied on businesses, transportation operators, and residents in the territories they control.

Extortion functions not only as a revenue stream but as a mechanism of social control, a parallel form of governance imposed on communities the state has abandoned.

In February 2025, the U.S. State Department formally designated ten criminal organizations as Foreign Terrorist Organizations, among them six Mexican cartels, MS-13, Venezuela-linked Tren de Aragua, and two Haitian gang coalitions.

Those designations reflect a clear recognition that these groups are no longer simply a law enforcement problem. They are, above all, a geopolitical one.

All of this poses a structural challenge for states, given that international law was built on the premise that the primary actors in global security are governments and that accountability flows through state institutions.

Meanwhile, non-state actors exploit every gap in that architecture, operating across borders, shifting jurisdictions, using legal entities in one country to launder funds in another, and in some cases even enjoying the covert protection of the very governments that publicly condemn them.