Check for Ransomware Signs as Attacks Surge in Late 2026
Ransomware incidents rose by fifty per cent in the third quarter of 2026, driven by rivalry between two dominant cybercriminal groups.
Key points
- Almost three thousand ransomware attacks occurred between July and September 2026, a fifty per cent increase from the same period last year.
- The Gentlemen and Qilin were the most active groups, accounting for over seven hundred attributed attacks combined.
- Nord Security researchers attribute the rise to market stabilisation following law enforcement takedowns of other ransomware gangs.
Organisations and individuals facing digital threats need to be aware that ransomware activity has intensified significantly in late 2026. According to analysis by Nord Security, almost three thousand attacks took place between July and September. This figure represents a fifty per cent increase compared with the same three-month period in the previous year. The surge affects a broad range of potential victims, as cybercriminal groups compete for market share.
Who is responsible for the increase?
Two specific cybercriminal groups, The Gentlemen and Qilin, dominate the current landscape. During the reporting period, The Gentlemen were linked to three hundred and eighty-three attacks. Qilin was responsible for three hundred and sixty-three incidents. These two groups have traded places as the most common perpetrators throughout 2026. Their intense rivalry appears to drive the development of new attack techniques, pushing both organisations to claim more victims than their competitors.
Why are attacks rising now?
The increase follows a period of reduced activity caused by law enforcement actions. Takedowns of groups such as Lockbit, BlackCat and RansomHub helped lower ransomware numbers during 2025. According to Nord Security, the market is now stabilising after these disruptions. Vakaris Noreika, vice-president of product research and development at Nord Security, described the current figures as the first step in a new era of ransomware. The stabilisation allows remaining groups to operate more aggressively.
What drives the competition between gangs?
Internal disputes within the cybercriminal underworld are fueling the competition. Mantas Sabeckis, a senior threat intelligence researcher at Nord Security, noted that The Gentlemen’s founder previously ran a top affiliate crew for Qilin. A dispute over an unpaid cut led to a public argument on an underground forum. The founder started a new group and lured former colleagues away with a ninety per cent payout. This offer was significantly higher than the usual seventy to eighty per cent rate.
What does this mean for other groups?
While The Gentlemen and Qilin lead the field, other groups remain active. Inc Ransom was the third most active group, with one hundred and ten attacks. Other organisations such as Krybit, Akira, Deadlock and Clop Leaks each recorded almost one hundred attacks. The Nord Security report suggests that the rivalry between the top two groups pushes all actors to innovate. This competitive environment increases the overall risk for potential targets across various sectors.
What affected people can do
Teams usually advise checking for unusual file extensions or locked data immediately. Users should verify the integrity of their backups to ensure they are clean and accessible. It is important to monitor email inboxes for phishing attempts that may mimic support requests. Employees should report any suspicious software behaviour to their IT department without delay. Organisations should review access logs for unauthorised changes. Staying vigilant helps reduce the impact of potential intrusions.
What to do and how to stay safe: Nord Security
- Verify that offline backups are current and isolated from the main network to ensure data recovery options remain viable.
- Monitor network traffic for unusual outbound connections that may indicate data exfiltration or command-and-control communication.
- Keep all software and operating systems updated with the latest security patches to close known vulnerabilities that attackers often exploit.
- Educate staff on recognising phishing emails and social engineering tactics, as these are common initial entry points for ransomware.
Step-by-step guide: Endpoint Detection and Response for Small Teams
General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many ransomware attacks occurred in Q3 2026?
Almost three thousand attacks, specifically 2894, took place between July and September 2026 according to Nord Security.
Which ransomware groups were most active?
The Gentlemen and Qilin were the most prolific, with 383 and 363 attributed attacks respectively during the quarter.
What caused the rise in ransomware activity?
Researchers suggest the rise is due to market stabilisation after law enforcement takedowns of other groups like Lockbit and BlackCat.
