These quadrants provide a quarter-by-quarter view of ransomware group dynamics. Each chart shows which groups were the most active in that specific three-month period, and how long they had already been operating. This makes it easy to spot emerging groups that suddenly increase activity, as well as established groups that continue to dominate over time.