Nearly 2,900 ransomware attacks were recorded worldwide between July and September 2026, a 50% jump compared with the same quarter last year, according to new analysis from Nord Security. The figure also represents an 8.6% rise over the previous quarter, suggesting that an industry many assumed was in decline is instead entering a more aggressive phase of reinvention.
A Market That Refused to Die
The rebound comes after a string of law enforcement operations that dismantled major ransomware operations, including Lockbit, BlackCat and RansomHub, through much of 2025. Those takedowns seized infrastructure, disrupted payment networks and, for a time, genuinely suppressed attack volumes. But the respite proved temporary. "Now, the market is stabilizing, and the numbers we see today are merely the first stepping stone in ransomware's new era," said Vakaris Noreika, VP of product research and development at Nord Security. The pattern echoes a familiar cycle in cybercrime: when dominant groups are dismantled, their expertise, tooling and affiliate networks do not disappear. They scatter, regroup and often return more adaptable than before.
Two Rivals, One Expanding Threat
Among the 2,894 attacks tallied in the quarter, two names dominate: The Gentlemen, linked to 383 attacks, and Qilin, close behind with 363. Inc Ransom trailed in third place with 110 incidents, while Krybit, Akira, Deadlock and Clop Leaks each approached the 100-attack mark. According to Nord Security researchers, the competition between The Gentlemen and Qilin is not incidental. Mantas Sabeckis, senior threat intelligence researcher at the firm, said intelligence gathered from underground forums suggests The Gentlemen's founder once ran a top affiliate crew for Qilin before a dispute over an unpaid cut drove him to break away. He then lured away former colleagues by offering a 90% payout share, well above the industry-standard 70% to 80%. That rivalry, researchers say, is fueling an arms race in tactics, with each group pushing the other toward faster, more scalable attack methods.
Encryption Loses Ground to Extortion
One of the clearest shifts this quarter is the move away from traditional file encryption. Rather than locking victims out of their systems, many attackers now simply steal sensitive data and threaten to leak it unless paid. "Stealing data is faster and simpler, so one group can hit many victims at once with far less effort. This shift is likely a big part of why attack volumes keep climbing," Sabeckis said, adding that encryption has not disappeared entirely but is no longer the default method. This matters for how organizations prepare: backups alone no longer neutralize the threat, since the danger now lies in exposure rather than inaccessibility.
The Doors Attackers Still Use
Despite the churn in group names and tactics, the way attackers get inside networks has barely changed. Compromised passwords, missing multi-factor authentication and unpatched vulnerabilities remain the most common entry points. "The names on the most prolific ransomware group list regularly change, but the way they get in doesn't," Noreika said. For businesses and individuals alike, that consistency offers a practical takeaway: strong authentication practices and timely patching continue to block the majority of attempted intrusions, regardless of which group is behind them. As ransomware enters what researchers describe as a new era, the basic hygiene of digital security remains the most reliable line of defense.
