Security News

Ransomware Attacks Jump 50% as Rival Gangs Compete for Top Spot

Infosecurity Magazine · 21 Oct 2026

Key Takeaway Ransomware is rising again after a quieter 2025, so make sure your business has tested offline backups and a clear plan for responding to an attack.

Almost 3000 ransomware attacks were recorded between July and September 2026, according to analysis by Nord Security. The total of 2894 attacks is a 50% increase on the same period last year and an 8.6% rise on the previous quarter (April to June).

The report, published on October 21, suggests law enforcement takedowns of groups such as Lockbit, BlackCat and RansomHub helped reduce activity during 2025. Nord Security's Vakaris Noreika said the market is now stabilising, and that current numbers are "merely the first stepping stone in ransomware's new era".

The two most active groups were The Gentlemen, with 383 attributed attacks, and Qilin, with 363. They have traded places as the most common perpetrator throughout 2026. Inc Ransom followed with 110 attacks, while Krybit, Akira, Deadlock and Clop Leaks each recorded almost 100. Researchers believe the rivalry between The Gentlemen and Qilin is pushing both to develop new attack techniques to claim more victims. Based on underground forum activity, Nord Security's Mantas Sabeckis said The Gentlemen's founder appears to have previously run one of Qilin's top affiliate crews before losing a dispute over an unpaid cut.

ransomware threat intelligence Qilin The Gentlemen SMB security

Summarised by CISO AI from Infosecurity Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.