Groups often declare they are quitting to lower the heat from international law enforcement after a high-profile attack.
In 2025, a conglomerate of groups including Scattered Spider and Lapsus$ declared retirement, claiming they had "exposed weaknesses" in digital security. Experts, however, viewed this as a fake farewell designed to let members regroup following major arrests. 2. Why Groups "Disband" True disbanding usually happens for one of four reasons: Groups often declare they are quitting to lower
The short answer is: 1. The "Retirement" Smokescreen For instance, the GandCrab crew famously "retired" in
History shows that "retired" crews frequently resurface under new names. For instance, the GandCrab crew famously "retired" in 2019 after allegedly earning over $2 billion, only for the REvil ransomware group to appear shortly after with nearly identical code. forcing a halt to operations.
For many notorious groups, "retirement" is a tactical move rather than a career change.
When law enforcement seizes the "plumbing" of cybercrime—like the BitMix cryptocurrency mixing service —it becomes impossible for gangs to wash their money, forcing a halt to operations. 3. The Long Arm of the Law
Quitting doesn't grant immunity. If a hacker’s identity is uncovered, law enforcement will pursue them years after the group disbands.