Surge in Ransomware Attacks: Nearly 3,000 Incidents Reported in Q3 2026
In a concerning trend that cybersecurity experts are monitoring closely, nearly 3,000 ransomware attacks were recorded between July and September 2026. This figure represents a significant increase compared to the same period in the previous year, highlighting the growing threat of cyber extortion.
According to a detailed analysis released by Nord Security, a total of 2,894 ransomware incidents were reported during this quarter. This alarming statistic indicates a staggering 50% rise relative to the same timeframe in 2025. Furthermore, the trend showcases an 8.6% increase in ransomware activity when compared to the second quarter of 2026, which raised considerable alarm among cybersecurity professionals.
The report, published on October 21, sheds light on various factors contributing to this uptick in ransomware activity. Notably, it suggests that recent law enforcement operations against well-known ransomware groups have inadvertently shifted the landscape. While previous actions against groups like Lockbit, BlackCat, and RansomHub appeared to temporarily reduce ransomware activities in 2025, the current market conditions reflect a new era in which these criminal enterprises have become increasingly aggressive.
Vakaris Noreika, the Vice President of Product Research and Development at Nord Security, conveyed a cautious outlook, stating, “Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware’s new era.” This statement indicates that while law enforcement efforts had some impact, they may not have provided a long-term solution to the ongoing struggle against cybercrime.
Dominance of Rival Ransomware Gangs
During this quarter, the report identified The Gentlemen and Qilin as the most prolific ransomware groups, underscoring a competitive dynamic that appears to be intensifying in the criminal underworld. The Gentlemen were attributed with 383 ransomware attacks, while Qilin closely followed with 363 recorded incidents. The significance of their rivalry is further accentuated by the fact that both groups have alternated positions as the leading perpetrators of ransomware attacks throughout the year.
In addition to these two major players, Inc Ransom emerged as the third most active group, responsible for 110 attacks. Other groups such as Krybit, Akira, Deadlock, and Clop Leaks also demonstrated considerable activity, each accounting for almost 100 ransomware incidents.
The rivalry between The Gentlemen and Qilin is indicative of an evolving criminal landscape. Mantas Sabeckis, a senior threat intelligence researcher at Nord Security, highlighted the transformative nature of their competition: “Based on underground forum activity we observed, The Gentlemen’s founder appears to have previously run one of Qilin’s top affiliate crews before a dispute over an unpaid cut.” This intense rivalry is reportedly pushing both groups to innovate new attack techniques in their quest to dominate the ransomware market.
The strategic shifts in tactics are notable, particularly with a focus on minimizing the traditional encryption methods commonly associated with ransomware attacks. Instead of encrypting data and threatening victims with loss of access, attackers are increasingly stealing sensitive information and threatening to leak it unless a ransom is paid. Sabeckis remarked, “Stealing data is faster and simpler, so one group can hit many victims at once with far less effort. This shift is likely a big part of why attack volumes keep climbing.” However, he cautioned that encryption is still a weapon in their arsenal, suggesting that the criminals are merely adapting to maximize their effectiveness.
Common Entry Points and Ongoing Vulnerabilities
Despite the evolution in methods, researchers noted that the initial entry points exploited by attackers have largely remained unchanged. Attackers frequently gain access through compromised passwords, the absence of multi-factor authentication, and unpatched security vulnerabilities. Noreika emphasized the importance of addressing these vulnerabilities: “The names on the most prolific ransomware groups regularly change, but the way they get in doesn’t.”
In conclusion, the increase in ransomware attacks during the third quarter of 2026 serves as a stark reminder of the ongoing battle against cyber extortion. With the landscape in constant flux due to the activities of rival groups and the adaptation of criminal tactics, both individuals and organizations must remain vigilant in their cybersecurity efforts. Protecting against familiar vulnerabilities may play a crucial role in mitigating the risks associated with ransomware, underscoring the ongoing need for robust cybersecurity measures.