Threat exposure management platform NordStellar has published its Q2 2026 ransomware analysis, covering 2,581 incidents from April to June. The quarterly total is down 4% from the 2,676 recorded in Q1 2026, but the first-half figure of 5,257 is 20% above the equivalent period in 2025, indicating that the elevated threat baseline established in late 2025 has held rather than retreated.
The analysis points to an increasingly concentrated attack landscape. Qilin led Q2 activity with 299 attacks, followed by The Gentlemen with 284, and DragonForce at 147. The Gentlemen increased its attack volume by 39% quarter-on-quarter — a rise that NordStellar links to competitive dynamics between the two dominant groups rather than structural growth in the broader ecosystem.
"Even though DragonForce remains significantly less active than the top two, it is steadily scaling up — last quarter's attack volume marked an all-time high for the group."
— Mantas Sabeckis, Senior Threat Intelligence Researcher, Nord Security
Small and medium-sized businesses continued to account for the largest share of victims, but the data shows a notable shift toward enterprise targets. Attacks on companies with revenues above $1 billion rose 74% from 23 incidents in Q1 to 40 in Q2. NordStellar suggests the increase reflects reputation-driven incentives within the criminal ecosystem, where landing a high-profile target signals competence to affiliates.
Geographically, the United States recorded 769 cases in Q2, followed by Canada (97), Germany (83), the United Kingdom (74), and France (51). Manufacturing was the most targeted sector at 19.5% of all attacks, followed by information technology (10.7%) and professional services (8.3%). Healthcare declined only marginally quarter-on-quarter, which NordStellar attributes to the sector's combination of sensitive data and operational sensitivity to downtime.
NordStellar monitors more than 200 ransomware group blogs to compile its data. The full methodology and report are available at nordlayer.com/intelligence/ransomware-statistics/.
To stay across the latest in cloud, AI and enterprise tech analysis from Compare the Cloud, subscribe to our weekly newsletter at https://www.comparethecloud.net/newsletter
