Almost 3000 ransomware attacks took place between July and September 2026 and the figure marked a significant increase when compared with the same period last year.
According to an analysis by Nord Security, the 2894 ransomware attacks which took place during the quarter represents a 50% increase when compared with the same period last year.
It also represents a slight increase when compared with the previous quarter of this year, as the July to September period saw an 8.6% rise in ransomware attacks when compared with April to June.
Published on October 21, the Nord Security report suggested that the significant rise in ransomware activity is a result of the impact of law enforcement takedowns on ransomware groups.
Researchers suggested that the action against the likes of Lockbit, BlackCat and RansomHub helped to reduce ransomware activity during 2025.
“Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era,” said Vakaris Noreika, VP of product research and development at Nord Security.
Rival Ransomware Gangs Drive Attacks
During the reporting period, the two most prolific ransomware groups were The Gentlemen and Qilin. Of those ransomware incidents which could be attributed, The Gentlemen accounted for 383 ransomware attacks, while Qilin was not far behind with 363 recorded attacks.
The third most active ransomware group during the period was Inc Ransom, which accounted for 110 attacks. Other groups which showed significant activity during the quarter with almost 100 ransomware attacks each include Krybit, Akira, Deadlock and Clop Leaks.
But it is The Gentlemen and Qilin which remain by far the most active ransomware gangs. The two threat groups have traded places as the most common perpetrator of ransomware attacks throughout 2026. The Nord Security research suggested that a rivalry between the two groups is pushing them both on to develop new attack techniques for claiming more victims.
“Based on underground forum activity we observed, The Gentlemen’s founder appears to have previously run one of Qilin’s top affiliate crews before a dispute over an unpaid cut, which he took to an underground forum and lost,” said Mantas Sabeckis, senior threat intelligence researcher at Nord Security.
“His answer was to start a new group and lure his former colleagues away with a 90% payout, well above the usual 70% to 80%. This quarter, the breakaway The Gentlemen group edged past Qilin by 20 attacks.”
Read More: Why Ransomware Remains One of Cybersecurity’s Most Persistent and Costly Threats
One of the techniques which has been deployed by both groups to remove the encryption element of the ransomware attacks. Rather than encrypting the data and holding it hostage that way, the attackers simply steal sensitive data from their victim and threaten to publish it unless they receive a ransom payment.
“Stealing data is faster and simpler, so one group can hit many victims at once with far less effort. This shift is likely a big part of why attack volumes keep climbing,” said Sabeckis. “But that doesn’t mean encryption is going away,” he added.
While ransomware groups continue to adapt and evolve, researchers noted that when it comes to the initial entry point for attacks, they have remained broadly the same. These include attackers exploiting compromised passwords, a lack of multi-factor authentication, on accounts and unpatched security vulnerabilities.
“The names on the most prolific ransomware group list regularly change, but the way they get in doesn’t,” said Noreika. “What happens once attackers are inside may be shifting, but closing those familiar openings still removes a large share of the risk.”
Click Here For The Original Source.
——————————————————–
