Ransomware continues to evolve from episodic attacks conducted by individual criminal groups into a broader and increasingly organised cybercrime economy. New research supplied by NordLayer Intelligence indicates that 2,894 ransomware incidents were recorded between July and September 2026. This represents a 50 percent rise from 1,933 incidents in the equivalent quarter of 2025, and an 8.6 percent increase on the 2,664 incidents recorded during the second quarter of this year.
According to the company, this is the highest quarterly total in its monitoring, which extends back to 2020. The findings add to evidence that ransomware remains one of the more persistent cybersecurity problems facing organisations. Earlier in 2026, Digital Journal reported separate data showing 5,189 publicly claimed ransomware attacks during 2024, illustrating the considerable scale already reached by the criminal ecosystem. That analysis also cautioned that leak-site monitoring is inherently incomplete: criminals publicise some victims to exert pressure, whereas other incidents can remain outside such datasets.
This distinction is important. NordLayer Intelligence’s new statistics are based on monitoring more than 200 ransomware-group blogs and analysing listings published by the attackers themselves. They should therefore be understood as observed or claimed incidents rather than an exhaustive count of every ransomware infection worldwide.
A more crowded ransomware marketplace
Perhaps the significant development is not simply that the number has risen, but what appears to be happening within the criminal marketplace. NordLayer Intelligence argues that the ecosystem has entered a more stable phase after disruption to prominent operations such as LockBit and the shutdowns of BlackCat and RansomHub. The implication is that disruption of individual ransomware brands, while important, does not necessarily dismantle the wider criminal economy.
There are signs elsewhere of this adaptability. Digital Journal has previously reported research suggesting cybercriminal activity is becoming more visible on mainstream messaging infrastructure. Analysis by NordLayer Intelligence found Telegram accounted for 45 percent of discussions across seven monitored cybercrime categories during the first five months of 2026, compared with 28 percent across 2025. The research suggests that criminal communities can migrate as established underground venues are disrupted.
In the latest ransomware dataset, two names stand out: The Gentlemen and Qilin. The former was linked by the researchers to 383 attacks during the quarter and the latter to 363, producing 746 incidents between them.
The emergence of The Gentlemen has previously been detected in other threat intelligence. Digital Journal reported in September that CloudSEK’s research into Middle Eastern cyber threats identified The Gentlemen among active ransomware organisations and associated the group with exploitation of a Fortinet vulnerability, VPN credential attacks and use of Rclone for data exfiltration. The same research also identified Qilin among active ransomware groups.
Extortion without encryption
Another important change concerns what the word ‘ransomware’ now describes. The classic attack involves malicious software encrypting files and demanding payment for their restoration. The contemporary extortion environment is broader. Attackers can steal information and threaten to release it, or combine exfiltration with encryption to create additional leverage.
NordLayer Intelligence cybersecurity expert Mantas Sabeckis argues that dropping encryption can make attacks easier to scale because stealing data can be faster than encrypting systems. Groups can consequently concentrate on the threat of disclosure rather than rendering computers unusable.
That does not mean encryption has disappeared. Instead, defenders potentially face several models simultaneously: encryption, data theft, or a combination of the two. This development matters because defensive thinking based solely upon recovering encrypted systems is insufficient. Reliable backups remain valuable, but restoring data does little to neutralise an extortion demand when criminals already possess sensitive corporate or customer information.
The trend has been evident for some time. Previous Digital Journal coverage described modern ransomware as involving multi-layered extortion, with criminals threatening publication as well as locking information. The same analysis highlighted supply-chain weaknesses, phishing and attacks against critical infrastructure among the wider cyber risks facing organisations in 2026.
The new research identifies smaller and medium-sized organisations with up to 200 employees and revenues below $25 million as particularly targeted, with manufacturing featuring prominently. This produces an uncomfortable asymmetry. A smaller company can hold commercially valuable information and depend heavily upon continuous access to digital systems, yet lack the security personnel and resources available to a multinational corporation.
Manufacturing has already attracted considerable ransomware attention. Earlier analysis reported by Digital Journal, based on separate ransomware monitoring, placed manufacturing at 28 percent of attacks where the victim’s sector was known. That research also identified smaller businesses as particularly exposed.
Nor is credential theft a theoretical concern. Recent Flare research found 422,747 stealer logs containing financial-services and banking credentials circulating on underground forums between September 2025 and August 2026, a 56.3 percent increase over the preceding period. Researchers highlighted particular concern about infected machines containing access to financial infrastructure.
Familiar doors, changing attackers
The defensive lesson from the NordLayer Intelligence research is arguably less exotic than the rapidly changing names of ransomware gangs. The researchers point towards stolen credentials, inadequate multi-factor authentication and known vulnerabilities in widely used enterprise technology as continuing routes into organisations. Criminal branding, affiliations and extortion techniques may change more quickly than these underlying weaknesses. This means organisations need to concentrate not just on identifying the latest ransomware family but on reducing the opportunities available to whichever criminal organisation happens to emerge next.
The challenge is likely to become more complicated as artificial intelligence lowers some technical barriers. Earlier reporting found cybersecurity specialists expect AI-assisted social engineering and AI-enabled malware to become increasingly important during 2026, including technology capable of producing more convincing phishing material. This potentially makes the human and identity layers of security still more consequential.
The 2,894 incidents identified by NordLayer Intelligence should nevertheless be interpreted with methodological care. The figure describes incidents visible through the organisation’s monitoring of criminal leak sites. It is not a complete census of ransomware attacks.
Yet the trajectory warrants attention. Ransomware groups are changing names, competing for affiliates and diversifying the ways in which they extract money. The important development may therefore be less the emergence of any single gang than the resilience of the market supporting them.
For businesses, the message is correspondingly pragmatic: concentrating on ransomware’s current leading brand risks missing the bigger picture. The actors may change, but compromised credentials, exposed systems and unpatched vulnerabilities continue to give them opportunities to get inside.
——————————————————–
Click Here For The Original Source.
