Ransomware groups listed 2,894 attacks between July and September 2026, an all-time high in the monitoring data kept by NordLayer Intelligence, part of Nord Security.
The total is up 50% on the 1,933 attacks recorded in the third quarter of 2025 and 8.6% on the 2,664 in the second quarter of 2026. NordLayer Intelligence, which tracks more than 200 blogs run by ransomware groups and holds data back to 2020, counts attacks from the listings the groups themselves publish.
Two groups account for 746 of them. The Gentlemen listed 383 attacks and Qilin 363. Mantas Sabeckis, a cybersecurity expert at Nord Security, said: "The rivalry between The Gentlemen and Qilin plays out like a 1980s soap opera". Based on underground forum activity, he said, The Gentlemen's founder appears to have run one of Qilin's top affiliate crews before a dispute over an unpaid cut, then started a new group and drew former colleagues away with a 90% payout, against the usual 70% to 80%.
Technique is changing too. Sabeckis said some groups now skip encryption altogether because stealing data is faster and simpler, letting one group hit many victims at once with far less effort. Cl0p is one of a growing number that rely on the threat of a leak alone.
Small and medium-sized businesses with up to 200 employees and under $25 million in revenue, in manufacturing, remain the most targeted. North America accounted for almost half of the attacks that could be located and Europe for more than a quarter. The researchers expect a seasonal rise: ransomware peaked in the fourth quarter of 2025 as attackers exploited end-of-year vulnerabilities and holiday staff shortages.
Vakaris Noreika, a cybersecurity expert at NordLayer Intelligence, said: "Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era." He said the names on the most prolific group list change regularly but the way in does not, and pointed to stolen logins protected by weak multi-factor authentication and known flaws in widely used enterprise products as the most common entry points, and noted that Akira has used exposed VPN credentials to encrypt data within hours.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
